Role-based access control
Every API route is protected by role checks. Staff only see the facilities and residents they're assigned to. Family portal access is scoped to a single linked resident via a magic link.
Security & trust
CareStead is built for care homes handling sensitive resident data. Here’s how we protect it — for managers, CQC consultants, and IT reviewers.
Encryption in transit
All traffic is served over TLS 1.2+. Fly.io terminates and auto-renews certificates for our custom domains.
Row-level security
PostgreSQL row-level security policies enforce tenant isolation at the database layer, in addition to application-level checks — so a bug in one layer doesn't expose another organisation's data.
Audit trail
Append-only audit logs record who changed what and when, across care plans, medications, incidents, and staff records — ready to export for a CQC inspection.
Clinical data stays clinical
Care notes, medication records, and incident details are never sent to error monitoring or analytics tools in plain text.
Rate limiting & hardening
Global and auth-specific rate limits, security headers (Helmet), and signature verification on billing webhooks protect against abuse.
Architecture
Built as a multi-tenant SaaS
- Data model: Organisation → Facility → Residents, with tenant isolation enforced at every layer.
- API: NestJS on Node.js with JWT authentication and PostgreSQL storage.
- Web: Next.js for the manager admin console and family portal.
- Mobile: offline-capable carer app with sync-on-reconnect for medication rounds.
- Payments: handled entirely by Stripe — CareStead never stores card details.
Compliance
Aligned with UK GDPR
Your care home is the data controller for resident records; CareStead is the processor, acting only on your instructions.
Found a security issue?
We take reports seriously and respond quickly. Please don’t disclose publicly until we’ve had a chance to fix it.