Two-factor on every account
TOTP from any standard authenticator, with recovery codes issued at enrolment. Enforced for every role including caregivers — not reserved for administrators, and not an upsell.
Security
The controls that ship, and the gates we have not cleared.
Every security page you have read claims bank-grade encryption. Here is a different offer: the controls that actually exist in the build, and a list of what is missing, written by the people who know.
In the product today
Eight controls, all verifiable in a demo.
Ask us to demonstrate any of these on a live instance. Several are covered by the automated test suite, which we will also walk you through.
Individual accounts only
There is no shared facility login. Every entry names a person, because an audit trail attached to "the front desk iPad" tells you nothing when it matters.
Role-based permissions
Permissions are granted per action and scoped by facility assignment. A user cannot see a facility they are not assigned to.
Per-facility isolation
Each facility gets a dedicated database. Tenant isolation is covered by the automated test suite, not just by a WHERE clause somebody remembered to write.
Append-only clinical record
Database triggers block UPDATE and DELETE on clinical tables, so immutability survives even a mistake in application code. Corrections attach as amendments showing both versions.
Hash-chained audit trail
Entries are chained, so tampering breaks the chain visibly. It covers reads of sensitive records as well as writes, and no role — including administrators — can edit or clear it.
Server-side clinical timestamps
Occurrence times are normalised from the facility timezone on the server. A device with a wrong clock, or a caregiver in another state, cannot misdate a clinical record.
Idempotent writes
Requests carry idempotency keys and clinical writes go through a transactional outbox, so a retried submission on bad hotel wifi does not double-record a medication pass.
/two-factor-challenge 
Not yet cleared
What an honest security page has to include.
External security assessment
Not yet completed. It is a named gate in the product's own release notes, and we intend to complete it with a design partner rather than claim it now.
Certification and HIPAA attestation
Neither exists today, and the release notes state in writing that the product must not be represented as certified or HIPAA compliant. If your jurisdiction requires an attested platform for PHI, CareIT AL is not that platform yet.
Single sign-on
Roadmap. Accounts today are local, with TOTP two-factor.
Penetration test report
Not available. When one exists, we will share it — not summarise it.
These are quoted from the product's own release notes rather than softened for a website. If a competitor's security page has no equivalent section, that does not mean they have no gaps — it means they did not print them.
Your data
- A dedicated database per facility — your record is not pooled with anyone else's.
- CSV exports of residents, medications, incidents and the audit trail, available from the product at any time.
- Backups are part of the managed hosting; restore testing is part of the operational runbook, and we will show you the runbook.
- If you leave, your data leaves with you. That is a contract term, not a favour.
Security questions we have not answered here? Email us — a real answer, including "we have not done that yet" where that is the answer.
Bring your toughest security question.
We would rather lose a deal on an honest gap than win one on a claim we cannot support.