Security overview

Separation between homes

Every home is its own workspace. Queries are scoped to the signed-in user’s home and role in the application, and the database also enforces row-level security per home, so a missed filter in code does not expose another home’s records.

An automated test signs in as one home and tries to read another home’s data through the database layer. It runs before changes are released.

Accounts and access

Passwords are hashed and sessions are secured. Two-step verification with an authenticator app and backup codes is available to every user, and managers and administrators are prompted to turn it on.

Access follows role. Care staff see their own records, managers and senior staff see the whole home, and every deletion is saved to an archive before the record is removed.

Sign-in, password reset, invitation, calendar and referral links are rate limited. Calendar and referral links can expire and be revoked.

Data in transit and at rest

All traffic uses HTTPS with strict transport security. Files are stored privately and served only to authorised users. Responses carry content-type, referrer and framing protections.

Audit and monitoring

Sign-ins, exports, approvals, deletions and administrative actions are written to an audit log. A health endpoint reports database and email status so uptime monitoring can alert us.

What we do not claim yet

We do not currently hold Cyber Essentials, ISO 27001 or any other certification, and we have not published an independent penetration test. When that changes we will say so here with the date and scope.

Reporting a vulnerability

If you think you have found a security problem, email us with the details. Please do not access data that is not yours. We will acknowledge your report and keep you informed.