Security posture

Controls in place

• Encrypted transport (TLS) for all web and API traffic.
• Supabase Auth with session cookies; mobile apps use bearer tokens over HTTPS.
• Row Level Security (RLS) on care data so users only see circles they belong to.
• Document vault stored in Supabase Storage with access scoped to the care circle.
• Stripe processes card payments; we store Stripe customer IDs, not full card numbers.
• Account deletion available in-app and on the web (Apple/Google store requirement).
• Audit-oriented activity feed and compliance CSV / inspection pack for facility plans.

Subprocessors

We use the following processors to run the Service. Regions depend on your project configuration and the vendor's infrastructure.

NHS / social care assurance

• DSCR application pack ready, DPIA, DSPT control map, clinical safety case (DCB0129/0160), data flows, retention/SAR runbook, and capability matrix are available for procurement (see Assurance pack and docs/compliance/). We are not yet NHS assured and not DSCR-certified; do not treat this page as an Assured listing.
• GP Connect, available only as a custom integration behind the gpConnect feature flag (default off), sandbox mode. This is not live NHS Spine access out of the box.
• DSPT, supplier Toolkit evidence mapping is under way. We do not claim “Standards Met” until a submission is published. Care homes remain controllers and complete their own DSPT; we supply a processor evidence pack on request.

Certifications roadmap

We do not claim DSPT Standards Met, Cyber Essentials Plus, ISO 27001, or NHS Assured status. Our DSCR application pack is ready for board review; we are not yet NHS assured. Basic Cyber Essentials and Toolkit submission remain on the near-term legal track. Pack artefacts live under docs/compliance/. Ask us if a procurement checklist blocks your purchase.