Sensitive data demands full control
A system that holds passports, payslips, home addresses and information about care recipients is a sensitive target. This page explains exactly which controls exist in the system, and what we do not claim.
Four principles that guide the design
Not a list of buzzwords — design decisions that shape what a user sees and is able to do.
Least privilege by default
A new user starts with no access, and every permission is granted explicitly. A site manager does not see payroll data unless it has been configured otherwise.
Separation between operations and sensitive data
The operational screens are built so that people can work in them without exposing sensitive fields, even for users with broad access.
Logging before convenience
Significant actions are written to the log even when that adds a step. You can reconstruct who did what and when.
Blocking, not just an alert
When a mandatory document is missing or an action exceeds a permission, the system stops it rather than merely flagging it.
Who sees what — by role
Permissions are defined at the module level, the record level and the field level. The table below shows a typical split, and it can be tailored to your organisation.
System administrator
Full access, including user and permission management
- Defining roles and permissions
- Viewing the audit log
- Managing system settings
- Reversing actions
Operations manager
Employees, sites, assignments and attendance — without full payroll data
- Managing assignments and replacements
- Approving attendance
- Handling exceptions
- Viewing cost at an aggregate level
Payroll accountant
Payroll data, pay components, deductions and exports
- Running the payroll calculation
- Handling payroll exceptions
- Exporting to the payroll software
- Viewing rate history
Site manager
Only the employees and data of the sites assigned to them
- Reporting and approving attendance at the site
- Viewing the status of missing documents
- Requesting a replacement worker
- No access to payroll data
Nursing care coordinator
Care recipients and caregivers in their area of responsibility
- Assigning caregivers
- Tracking visits
- Handling incidents
- Managing family consents
External client
Limited viewing and approval, restricted to their own workers and hours
- Viewing reported hours
- Approving hours
- Viewing invoices
- No access to employee files
Employee
Their own personal information only
- Viewing their assignment and hours
- Submitting requests
- Viewing their own documents
- Updating contact details
Family member
Operational information about a single care recipient, subject to documented consent
- Viewing visits that took place
- Viewing updates that were shared
- Receiving predefined notifications
- No access to the medical record
What is recorded in the audit log
The log is there to answer one question: who touched this data, when, and what exactly changed.
What we claim — and what we do not
The system was designed with permission layers, logging and controls appropriate for working with sensitive data. It matters to us to phrase this precisely, without statements we cannot back up.
- We do not claim any certification or accreditation, and we do not claim compliance with any particular standard.
- We make no claim of compliance with any foreign regulation. Alignment with the requirements that apply to you is examined individually during implementation.
- Backup policy, data retention and storage location are determined according to the deployment environment you choose and are documented in the agreement.
- Information security is a shared responsibility: we are responsible for the controls within the system, and you are responsible for managing users, passwords and internal policy.
- We prefer to state exactly what exists today rather than promise capabilities that are not yet complete. Capabilities in development are marked as such.
Security — frequently asked questions
The storage location is determined by the deployment environment you choose and is set out in the agreement. We do not make a blanket statement here, because the answer differs between clients.
Do you have an information security questionnaire?
Send it to us and we will answer it precisely, including the parts that do not exist yet.