HearthTrust
Trust & assurance
What commissioners, framework assessors and IT reviewers ask us, answered in one place. Where something is roadmap rather than reality, this page says so.
| Data residency | All customer data is stored in the United Kingdom (London) on managed PostgreSQL. |
|---|---|
| Encryption | TLS in transit (HSTS preloaded); AES-256 at rest; authenticator secrets additionally encrypted at the application layer. |
| Tenant isolation | Each organisation's data is separated by database-enforced row-level security (FORCE ROW LEVEL SECURITY on every table), not application code alone. |
| Audit trail | An append-only audit log records who created, viewed, changed and exported what, and when. Enforced at the database layer: no application role can edit or delete audit entries. Included as standard, never an add-on. |
| Access control | Password plus six-digit authenticator code for every account, including administrators. Role-based access with a read-only Reg 44 visitor role. Admins can suspend any account instantly, ending all its live sessions. |
| Record integrity | Children's records are never destructively edited or deleted: corrections create a new version and the original is preserved. Statutory retention (to the 75th birthday) is designed in. |
| Backups & recovery | Automated daily backups with point-in-time recovery on the managed database platform. Forward-only, checksummed schema migrations, rebuild-tested against a clean database. |
| Data portability | A complete organisation export (JSON) is available to managers at any time, self-serve. Leaving customers receive a full export; reading and exporting records is never blocked, including during billing disputes. |
| Integrations | Read-only REST API with revocable bearer keys, and signed outbound webhooks (HMAC-SHA256) for record events. |
| Multi-home & groups | One organisation runs any number of homes: per-home access control, regional-manager delegation, a Responsible Individual overview across every home, organisation-wide reporting and white-label branding. |
| Company & registration | Hearth is a trading name of Hearth Systems Ltd, registered in England and Wales (company no. 17349265). Registered office: 20 Turner Road, Bean, Kent, DA2 8BA. ICO registration: ZC205445. ICO registration: ZC205445. |
| Status & support | UK-based support at hello@carehearth.co.uk; incidents and maintenance are notified to customers directly. A public status page is on the roadmap. |
Local authorities and larger groups
Hearth supports framework, block-contract and group deployments: unlimited homes per organisation, delegated regional management, organisation-wide audit and reporting, and white-label portals per organisation. For tenders, DPS applications or a completed security questionnaire, email hello@carehearth.co.uk and we will respond within one working day.
Hearth is a trading name of Hearth Systems Ltd, registered in England and Wales (company no. 17349265). Registered office: 20 Turner Road, Bean, Kent, DA2 8BA. ICO registration: ZC205445.
Last updated: 5 July 2026.