Security overview

Plain-English answers to the questions a home's DPO, IT support or placing authority will ask, with every control marked honestly as implemented today or planned. We'd rather tell you the gaps up front than fail your audit later.

Where your data lives

• UK hosting. The database runs in London, United Kingdom (AWS eu-west-2, managed by Supabase), and the application is served from London infrastructure. Children’s records are stored and processed in the UK. Implemented
• Encryption. All traffic is encrypted in transit (TLS, with HSTS preloading), and the database and its backups are encrypted at rest by the managed host. Implemented
• No trackers. The site and app run no third-party analytics or advertising scripts, and fonts are self-hosted so no visitor data leaks to font CDNs. Implemented

Keeping one home's data away from another's

• Tenant isolation in the database itself. Every organisation’s records are separated using PostgreSQL row-level security, enforced on every transaction. The application connects as a restricted role that cannot bypass that isolation and cannot delete audit records. Cross-organisation access is tested against the live production database. Implemented
• Role-based access within a home. Carer, manager, Responsible Individual, organisation admin, and a read-only independent-visitor role for Regulation 44 visits. Staff/HR files are restricted to manager roles; per-home access is enforced for multi-home organisations. Implemented

Signing in

• Multi-factor authentication is mandatory for every account (including managers) using a six-digit authenticator code alongside a password. Enrolment cannot be skipped or turned off by anyone, including us. A member of staff may tick “trust this device” at sign-in, which skips the code on that one device for up to a week; it is never ticked for you, the password is still required every time, and the Reg 44 visitor login always requires the code. Implemented
• Modern password storage (argon2id) and rate-limited sign-in attempts. Implemented
• Revocable sessions. Sessions live server-side and are checked on every request, so a manager can cut off a departed staff member’s access immediately. Password resets are issued by the home’s manager, not by guessable email links. Implemented

The record itself

• Append-only audit trail of who recorded, viewed, edited and exported what, kept with the record. Implemented
• No silent edits. Correcting an entry creates a new version and preserves the original. Records are superseded, never overwritten, and children’s records are never deleted, only archived in line with statutory retention. Implemented

Application hardening

• Strict per-request Content-Security-Policy (nonce-based, no inline scripts), HSTS, frame embedding blocked, restrictive permissions policy. You can verify these headers from your own browser right now. Implemented
• Input validation on write endpoints and a central authentication gate on every application route. Implemented
• Forward-only, transactional database migrations; destructive reset tooling is blocked in production. Implemented

AI features and children's data

• AI drafting (voice-to-log, summaries, pattern-spotting) sends record content to our AI subprocessor (Anthropic) only when a home has enabled the feature, produces drafts a person must review, and is never used to train models. Implemented
• AI features stay off for real children’s records until the AI-provider data-processing agreement and international-transfer safeguards are in place and reflected in the subprocessor register. This is the gating rule we hold ourselves to. Planned

What we haven't done yet, said plainly

• Independent penetration test of the application and infrastructure. Planned
• A rehearsed backup-restore drill: backups exist and are encrypted; a documented, timed restore test is the outstanding piece. Planned
• Cyber Essentials certification, then ISO 27001 on the roadmap after it. We claim no certification we do not hold. Planned
• Error monitoring configured to exclude child data from logs. Planned

If your organisation has a due-diligence questionnaire, send it over. We answer it against this page, with the same honest status on every line. A signed Article 28 data processing agreement, subprocessor register and breach-response commitment are part of onboarding for every home.

← Back to Hearth