Security & compliance
Written for the person who has to sign off on this.
Certifications
Where we actually are.
SOC 2 Type II
In progressEvidence collection is underway. Type II requires an observation window of several months, so we are not claiming it and will not until the report is in hand. Type I timing available on request.
Penetration testing
AnnualThird-party application penetration test annually, plus retest of any high or critical finding. Executive summary available under NDA.
HIPAA
Designed for, not claimingWe are most likely not a covered entity. We build as though we will become a business associate — encryption, access logging, BAAs with vendors touching health data, minimum-necessary access — so that integrating with a health-plan or hospital client later isn't a rebuild.
Data protection
What we hold, and what stops the wrong person seeing it.
Tenant isolation is enforced by row-level security in the database, not by application-layer checks. An employer administrator cannot read a care recipient's medical notes or a caregiver's care notes — and there is a test in our suite that proves it, run on every commit.
| Class | Examples | Controls |
|---|---|---|
| Sensitive health | Medical notes, cognitive notes, immunisation records, care notes describing a condition | Column-level encryption under a dedicated KMS key. Every access logged. Structurally excluded from analytics, application logs, and any model prompt. |
| Sensitive identity | Child names and dates of birth, home addresses, background-check identifiers | Row-level security by tenant. Encrypted at rest. Never present in any employer-facing view. |
| Operational | Booking times, statuses, ratings, entitlement ledger entries | Standard row-level security. This is the layer your usage reporting is built on. |
| Public | Caregiver first name and last initial, bio, certifications, aggregate rating | No restriction. This is what a family sees before a booking is confirmed. |
Access & authentication
Controls
Encryption
TLS 1.2+ in transit. AES-256 at rest. Health-classified columns encrypted separately under a dedicated key.
SSO / SAML
SAML and OIDC available for employer accounts. SSO-domain verification is also how most clients establish eligibility.
MFA
TOTP multi-factor is mandatory — not optional — for every internal operations role and every employer administrator.
Least privilege
Six roles with separate policies. Internal staff access to production data is logged and reviewed.
File storage
All buckets private. Access exclusively through short-lived presigned URLs.
Secrets
Held in a managed secret store. Never in the repository, never in environment files under version control.
Dependency scanning
Automated scanning in CI. High-severity findings fail the build.
Commitments
What we sign up to
Data processing agreement
Available before contract, so your legal review runs in parallel with commercial terms rather than after them. We'll also sign yours.
Incident response
Security incidents affecting your data: notification within 72 hours of confirmation, with what we know and what we don't.
Care incidents
Separate path. High-severity or any allegation of harm pages our on-call immediately and auto-pauses the caregiver pending review. Records are append-only.
Data subject requests
Export and deletion endpoints for an individual's full record. Audit events are retained under legal hold, and we'll tell you exactly what that covers.
Retention
Bookings and audit events, 7 years. Message bodies purged 30 days after a booking completes. Care-note photos purged at 90 days unless attached to an incident. Background-check reports are never stored — status and identifier only.
Accessibility
WCAG 2.2 AA is the target across family and caregiver surfaces. A VPAT is available; where we fall short, it says so.
Subprocessors
Everyone who touches your data.
Current as of this page's last update. We give 30 days' notice before adding a subprocessor that processes personal data.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | United States |
| Vercel | Application hosting and CDN | United States |
| Checkr | Criminal and motor-vehicle background checks | United States |
| Persona | Identity verification and liveness check | United States |
| Stripe | Payments, caregiver payouts, employer invoicing | United States |
| Twilio | SMS and voice notifications | United States |
| Resend | Transactional email | United States |
| Mapbox | Geocoding and drive-time calculation | United States |
| Sentry | Error monitoring (PII scrubbed before transmission) | United States |
| PostHog | Product analytics (no PII or health data in events) | United States |
Send us your security questionnaire.
We'll turn it around in five business days, and we'll answer 'no' where the answer is no.