Data map · Midnight Census

This table is generated from the same file our build checks against the database: a column we add without describing it here fails the build. We collect nothing about patients and nothing about a clinician's own health. No trackers, no tag manager, no session replay.

Fields

What	Why we hold it	Where it lives	Who can read it	When it goes
Account id	Ties your sign-in to your settings. A random id, not derived from anything about you.	`identity.user.id`	The identity role. The compensation side never sees it; a salary row carries a keyed hash of it instead.	With the account, within 24 hours.
Account dates	When the account was made and, if you asked, when it was removed.	`identity.user.created_at` `identity.user.deleted_at`	The identity role.	With the account.
Login email	To sign you in and to send account notices. Never shown, never given to a recruiter.	`identity.user.login_email`	The identity role.	With the account, within 24 hours. An institutional email used only to verify you is removed 30 days after confirmation unless you keep it as your login.
NPI, encrypted	To look your registry record up again for a later step of the gate. Kept only when such a step is switched on (the license comparison or the practice phone code); by default it is empty and the NPI is never stored.	`identity.npi_check.npi_encrypted`	The identity role, for 30 days.	30 days after verification, by a scheduled purge. The date is computed from verified_at.
NPI, salted hash	To stop one clinician opening two accounts. It cannot be turned back into the NPI.	`identity.npi_check.npi_hash`	The identity role.	With the account.
Verification results	Whether the registry match succeeded, and when; and, for the steps that are switched on, the license check, the phone code and the work email. The last four digits of the practice phone are kept only when that step is on, so the page can say where the code went.	`identity.npi_check.user_id` `identity.npi_check.name_matched` `identity.npi_check.taxonomy` `identity.npi_check.license_state` `identity.npi_check.license_matched` `identity.npi_check.phone_last4` `identity.npi_check.phone_verified_at` `identity.npi_check.email_verified_at` `identity.npi_check.no_work_email` `identity.npi_check.verified_at`	The identity role.	With the account.
Verification codes	The one-time code sent to your practice phone or work email, stored as a hash with where it went, how many tries were made and when it expires. Ten minutes, five tries.	`identity.verification_code.*`	The identity role.	When the code is used, and with the account.
The linking key	The only way to connect a person to their salary row. It is a secret key, not personal data, but it is listed because it is what keeps the two apart.	`identity.hmac_key.*`	The identity role can read it. No other role can, and the compensation side never holds it.	Rotated, never exported.
Your pay row	The compensation figures you submit, the specialty, geography, experience band and job attributes that give them meaning.	`comp.salary_record.*`	Public only in groups of five or more. The row itself is readable by the compensation role and moderators. It carries no name, NPI, email or employer name you did not choose to give.	When you delete it, within 24 hours. Excluded from every public view by the age rules after 36 months regardless.
Submitter key	A keyed hash of your account id, so your row can be found for edit and delete without storing who you are next to your pay.	`comp.salary_record.submitter_key`	The compensation role sees the hash. Only the identity role can compute it.	With the row.
Screening flags on your row	What the automated screen or a reviewer noted about the row (an outlier, a duplicate, arithmetic that does not add up), so a person can decide before it publishes.	`comp.row_flag.*`	The compensation role and moderators, next to the row and never with who you are.	With the row.
Submission fingerprint	A hash of your network address and browser at the moment you submitted, to catch one device submitting under several identities, and the values you confirmed as unusual on the form.	`comp.submission_meta.*`	The compensation role. The fingerprint is compared by the screen only.	The fingerprint is cleared 30 days after submission; the rest goes with the row.
Three-digit ZIP	To place the row in a metro. Stored, never displayed, never in any public cut.	`comp.salary_record.zip3`	The compensation role.	With the row.
Consent records	The legal record of each time you turned the referral setting on or off, with the exact text you agreed to and who the recipient was at that moment.	`referral.consent_record.id` `referral.consent_record.user_id` `referral.consent_record.consent_version_id` `referral.consent_record.action` `referral.consent_record.recipient_snapshot` `referral.consent_record.created_at`	The referral role. Shown to you on your account page.	Kept, with your account id replaced by a tombstone when you delete your account. The record is the proof of what you agreed to.
Consent request fingerprints	A hash of the network address and browser at the moment of consent, to show the consent was given from your session.	`referral.consent_record.ip_hash` `referral.consent_record.user_agent_hash`	The referral role.	Cleared when you delete your account.
Referral preferences	Off by default. If you turn it on, the specialties, places, pay floor and role types you would consider. A recruiter search must fall inside them to find you, and sees a random reference, not your account id.	`referral.opt_in.user_id` `referral.opt_in.candidate_ref` `referral.opt_in.active` `referral.opt_in.active_consent_record_id` `referral.opt_in.specialties` `referral.opt_in.states` `referral.opt_in.cbsa_codes` `referral.opt_in.comp_floor` `referral.opt_in.role_types` `referral.opt_in.updated_at`	The referral role. One recruiting firm, MedStaff Nationwide, through a view that answers only a complete search.	When you turn the setting off the row leaves the view at once; the row is removed when you delete your account.
Contact details for referral	The channel and the phone number or email you entered for a recruiter to use. Entered here, not copied from your login.	`referral.opt_in.contact_channel` `referral.opt_in.contact_value`	Revealed to a recruiter only by a function that writes the contact log first, at most 50 reveals a day per recruiter.	With the referral row.
Contact log	Every time a recruiter revealed your contact details: when, which channel, which recruiter, and their note. Shown to you on your account page.	`referral.contact_log.*`	The referral role. You.	Kept, with your account id replaced by a tombstone when you delete your account.
Recruiter directory	The display name of each MedStaff recruiter login, so your contact log can say who looked you up.	`referral.recruiter.*`	The referral role. You, on your account page.	When the recruiter's access ends.

Change log

2026-09-22Page published, generated from the data map file that CI checks against the database.