What we actually do, and what we do not claim.

The boundary between homes is in the database.

Most multi-tenant software keeps one customer's records away from another's by filtering in the application: every query remembers to add a condition, and the day one forgets is the day of the breach. Careframe does that too, and then does not rely on it.

Underneath, the database enforces the boundary itself. Postgres row-level security is switched on across the schema, and a request opens its database transaction under a restricted role carrying who you are, which company and which homes you may see. A query that forgets its filter returns nothing rather than returning somebody else's home.

• Per home and per module

  Access is granted on a grid: this person, at this home, for this part of the app. Being a manager somewhere does not make you a manager everywhere.

• A restricted database role

  The application does not connect as an administrator. It connects as a role the policies apply to.

• Set per request

  Your identity is set on the transaction and lasts for that transaction only — it cannot leak into the next request.

• Tested as the app role

  The database tests run as the restricted role, so a policy that would fail in production fails in the test too.

An audit trail nobody can tidy up.

Careframe records who did what and when, and the audit log is append-only at the database level through several independent mechanisms — not by convention, and not by the application politely declining to offer a delete button. A row cannot be edited or removed, including by us.

That matters twice over: it is how you answer a question about a record months later, and it is itself evidence that access to the home's records was controlled.

Sign-in, and sharing with an inspector.

Any account can turn on two-step sign-in with an authenticator app, with recovery codes for the day the phone is lost. Once it is on, new sessions ask for it, changes to it are rate-limited, and the account holder is emailed when it changes.

Inspectors and other visitors never get a staff account. They get a pass that is issued from inside the app, scoped to a home, and expires. A child's records sit behind a further deliberate consent step, and every record opened under a pass is logged against it.

What we keep, and what we throw away.

Records have retention rules and Careframe enforces them on a schedule rather than leaving old material lying around: applicant data is purged, expired evidence bundles are deleted outright, and abandoned drafts are cleaned up.

When something goes wrong, our error reporting is configured not to send us personal data — cookies, request bodies, headers and the signed-in user are stripped before a report leaves the application.

Where it runs.

Careframe runs on Vercel and Supabase. Those providers supply the hosting, encryption in transit and at rest, and the backup infrastructure. Our application servers run in the EU.

Read next

• Compliance
• Director view
• Staff files