How resident records are protected
This page is maintained by Steps To Living to answer the questions operators, referral sources and families ask about Steps To Sober Living. It describes controls that are live in the product today. It is a description of our own practices — not an independent audit, certification or legal opinion.
Access control
- Every account has one role — operator or resident — assigned at signup and enforced in the database, not just in the interface.
- Row-level security means an operator's queries can only ever return records they own. There is no cross-house read path, including for support.
- Residents can read their own record, their own documents, their own rent history and announcements shared with their house. Nothing else.
- Signed-in sessions end automatically after 30 minutes of inactivity, with a warning before sign-out.
- Passwords are hashed by the authentication provider and never stored or visible to us in readable form.
Minimum necessary
- The AI helper's conversation content is never shown to house staff. When it detects risk language, staff receive a severity flag and a timestamp — not the transcript.
- The public directory shows program contact details only. Resident data is never published, indexed or included in any listing.
- Drug-test photos live in a private storage bucket and are opened through short-lived signed links, not public URLs.
Audit and accountability
- Access to resident contact information is written to an append-only log recording who looked, which fields, when, and from where. Operators can read that log but cannot alter or delete it.
- Payment records, receipts and subscription events are write-protected once created.
- Every drug test carries a timestamp, observer, panel type and photo confirmation so chain of custody is documented at entry rather than reconstructed.
Data in transit and at rest
- All traffic is served over TLS. Database storage and file storage are encrypted at rest by the hosting provider.
- Card details are never entered into or stored by this application; payments are completed on the payment processor's own hosted pages.
Retention, export and deletion
- Operators can export any dataset — roster, rent, testing, curfew, meetings — as PDF or CSV at any time.
- Any account holder can download a complete copy of their own data and delete their account from the Account page. Deletion removes the account and the records it owns.
- Records are retained while the account is active. Operators are responsible for setting a retention period that matches their state licensing and funder requirements.
Readiness worksheet
Inside the app, operators get a self-assessment worksheet that organizes the paperwork a licensing body, funder or referral partner commonly asks to see. It is a private preparation tool for your own records — it is not an application, an inspection or any form of certification, and nothing entered in it is submitted anywhere.
Administrative & operational
The paperwork, money handling and governance a reviewer will ask to see.
Recovery support
How the residence actually supports recovery, not just houses people.
Physical environment
The building itself, and whether it is safe and habitable.
Good neighbor
Being a residence the surrounding block does not organize against.
Requirements differ by state and by program. Confirm what applies to your residence with your own counsel and your state authority.
Privacy and legal responsibility
Steps To Sober Living makes no claim about which privacy laws apply to your residence, and makes no regulatory or certification claim about itself. What we publish is the list of technical safeguards above, which you are welcome to verify. Determining your own legal obligations — and putting the consents, agreements, training and retention rules in place to meet them — is the operator's responsibility, with their own counsel.
If your organization needs a specific written agreement in place before using this software, contact will@stepstolivingllc.com and we will review the request.
Who is responsible for what
Steps To Living (this software)
Building and maintaining the technical safeguards listed above, keeping the platform patched, and notifying operators of a security incident affecting the platform.
The operator using this software
Obtaining resident consent, setting who on staff gets an account, choosing a retention period, meeting state licensing and certification requirements, and deciding what belongs in a note field.
The resident
Keeping their own login private and telling their house manager if they think their account has been accessed by someone else.
Reporting a problem
If you believe resident data has been exposed, or you have found a vulnerability, email will@stepstolivingllc.com with the details. Please do not test against another operator's live data. We will acknowledge a report and tell you what we found.
See also our Privacy Notice and Terms. Last reviewed July 31, 2026.