Security

All data is encrypted in transit using TLS and at rest by our managed hosting sub-processor. Card details are handled entirely by our payments sub-processor and never touch CareLedgerPro servers.

Access is scoped by role and enforced with row-level security on every client-facing table. Staff only see the records their role permits, and permissions can be updated or revoked by an administrator.

Transactions, corrections and sign-offs are recorded in an append-only audit log with the actor, timestamp and reason. Records are not silently edited; corrections keep the original entry visible.

CareLedgerPro uses staff-only sign-in with strong password hashing and leaked-password protection enabled at the identity provider. There is no public sign-up, and no family or resident-facing login.

CareLedgerPro runs on managed cloud infrastructure provided by our hosting sub-processor. UK/EU-aligned regions are used where available. Full details are on the Sub-processors page.

Database backups are managed by our hosting sub-processor. Restore is available in the event of an incident, in line with their published backup policy.

Application and database access rules are written to grant the minimum access required. Row-level security policies are the primary boundary between tenants.

If a security incident affecting a Controller's data occurs, we notify the Controller without undue delay. The Controller remains responsible for assessing the breach and notifying the ICO where required.