Security
Security is part of the workflow — not an add-on.
Every control on this page is something the product does, not something it intends to do. All of it is observable in the interactive demo.
The controls09
Nine controls, written as facts.
Access follows assignment
A staff member sees the clients they are actively assigned to. Others are not listed, do not appear in search, and cannot be opened by typing the address. A record somebody may not reach is reported as not found rather than forbidden — because 'forbidden' would confirm the person exists. Ending an assignment removes access on the next request.
Three checks, not one
Every read passes an organisation check, a relationship check and a sensitivity check. Holding a permission is not access; it is permission to see the records you are related to. Hidden navigation is never the control — every page and every action re-checks on the server.
Individual accounts and two-factor
Everyone is invited and sets their own password; nobody sets it for them. Roles that reach client data cannot do so without two-factor enrolled, and whether all staff must use it is your policy. Changing a password or deactivating an account revokes existing sessions.
Private document delivery
Files are held in private storage and delivered through short-lived signed links, so a copied URL stops working. Every upload is scanned before anyone can open it, and a scanner that cannot be reached holds the file rather than releasing it unchecked.
Records that hold their shape
An approved case note locks: never edited, never deleted. Corrections are addenda, so the original stays exactly as written with its author and time. Clock events are append-only. Closed periods do not reopen.
Append-only audit history
Who did what, to which record, and when — including who opened a document and who ran an export. It cannot be tidied up afterwards, which is what makes it able to answer a review.
Message content stays behind authentication
Notification email tells somebody a message is waiting. It does not contain the message. Email is not a controlled surface.
Location only at clock in and clock out
Captured at those two moments and at no other time. There is no background tracking. A failed capture is recorded as a failed capture and does not block the clock — blocking would only lose the record of real work.
Browser-local portal help
The help panel answers from a table shipped with the page. Nothing typed into it leaves the browser, because there is no request to make.
The history that answers a review.
Every action lands in an append-only history — sign-ins, views, edits, approvals, exports — with who, what, which record, and when. When a reviewer asks “who opened this file?”, the answer is a filter, not an investigation.
What we do not claim
No internet-connected system can guarantee absolute security, and we will not tell you otherwise. We are not certified or endorsed by any state agency. HIPAA obligations depend on your agency's arrangements and agreements — the platform is built to support them and cannot confer compliance on its own. Electronic visit verification workflows are supported and HHAeXchange configuration is held; we do not describe that as a completed integration.
Watch access appear and disappear, live.
In the demo, end an assignment and switch to the staff view — the client is gone from the list, from search, and from the address bar. That is the product, doing it.