Trust & Security

1. Where your data is held

Every care record, note, document and photograph sits in a PostgreSQL database hosted in AWS London (eu-west-2). It does not leave the United Kingdom in the ordinary course of running the service.

Data is encrypted in transit — the site and both apps are HTTPS only, and the strict-transport policy covers every company's subdomain — and at rest on the underlying storage.

2. How companies are kept apart

This is the question that matters most in multi-tenant care software, so here is the honest detail rather than a reassurance.

Every table in the database carries the owning company, and separation is enforced by PostgreSQL Row-Level Security — rules that live in the database itself and are applied to every query. It is not a filter our application code remembers to add. If a query forgot its company filter tomorrow, the database would still return nothing belonging to anyone else.

Each company also gets its own address — yourcompany.carelo.co.uk — but that is for routing and branding. The identity that decides what data you can reach comes from your signed-in session, never from the web address.

3. Care documents and photographs

Care plans, assessments, body-map photographs, supervision records and any file you upload are held in private storage. There is no public link to them, and no link that keeps working if it is forwarded or leaks.

When a member of your office staff opens a document, we check they are signed in and that the document belongs to their company, and only then issue a link that expires within sixty seconds. Files uploaded by carers or families are checked against their actual contents, not just their file name, so a document cannot smuggle in something else.

4. Who can see what

Access follows the job, and the limits are enforced on the server, never by hiding buttons.

• Office staff — owner, manager, coordinator and a view-only role. Company settings, pay policy and staff accounts are restricted to owners and managers.
• The view-only role cannot write anything. That is enforced on every table in the database, so it holds even if someone bypasses the screen entirely.
• Carers see their own visits and only the service users they are assigned to. Their app is tied to a registered device with a private PIN, limited to three devices per carer.
• Families see only what your office chooses to share, for their relative alone.
• Regions can further narrow what a coordinator sees, where a company runs several areas.

5. Every change is recorded

Care records are evidence, so Carelo is built to keep them honest rather than tidy. Changes are written to an audit trail with who made them and when, and the system deliberately refuses to rewrite history:

• A visit a carer has checked into is a delivered call and cannot be cancelled or deleted — it stays part of the care record.
• Cancelled visits are marked cancelled, never removed, so the reason survives.
• Check-in and check-out are recorded with time and location, and work offline — a carer with no signal still gets an accurate record, uploaded when signal returns.
• Records struck out in error are kept and marked, not erased.

6. How we build and patch

Every change runs through automated type checking, linting and an automated test suite before it ships, and dependencies are scanned for known vulnerabilities. When something is found, it is fixed and the fix is recorded — including what the problem was, who it could have affected and how the fix was verified.

We would rather tell you that plainly than claim nothing ever goes wrong. Software that never reports a defect is usually software nobody is checking.

7. Who else touches the data

We use a small number of established suppliers to run the service. These are our sub-processors under the Data Processing Agreement:

Carelo AI is off unless you turn it on, and it is built to read rather than change your records. Billing never receives care data.

8. Your data stays yours

You are the data controller for your service users' records. We are your processor, on the Article 28 terms set out in our Data Processing Agreement, and we process those records only to run the service for you.

• Export whenever you like — rosters, timesheets, care records and matrices export to Excel and PDF from inside the product, without asking us.
• Leaving — if you go elsewhere, you can take your data with you. We are not interested in holding a care provider hostage with their own records.
• Subject access and erasure — we support you in answering requests from the people you care for.

Our full Privacy Policy and Terms of Service set the rest out formally.

9. What we are working towards

We would rather you hear this from us than discover it in a procurement questionnaire. Carelo is a young product built by a small team, and there are recognised assurances we are working through rather than claiming:

If one of these is a condition of buying, tell us where you are in your process and we will be straight with you about our timing rather than promising a date to win the meeting.

10. Ask us anything

If you are completing a supplier assurance questionnaire, send it over — we would rather answer your form properly than hand you a brochure. If you believe you have found a security problem in Carelo, please tell us before telling anyone else, and we will work with you on it.