Security and privacy

Straight answers about how we protect your data

You trust us with records about your staff and the people you support. This page explains what we do to protect them, and what we have not done yet.

Contact our security team Read the Privacy Policy

Safeguards

What is in place today

Protecting data

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)
Data stored and processed in the United States
Each organization’s data is kept separate from every other organization
AI features work on your blank form and document templates, not on completed forms

Controlling access

Role-based permissions for administrators, HR, managers, staff and care workers
Care workers see only their own information
Passwords hashed with bcrypt and checked against known breached passwords
Session timeouts, device tracking and the ability to sign out other sessions
Face ID, Touch ID or fingerprint lock in the care worker app

Records you can rely on

Audit trails for signatures, document changes and key account actions
Electronic signatures with consent capture, designed for the ESIGN Act and UETA
Daily compliance snapshots you can show an auditor
Security and audit logs kept for at least one year

How we operate

Least-privilege access for our own team
Due diligence on every subprocessor, with a public subprocessor list
Vulnerability monitoring and error tracking configured to exclude health information
Breach notification to customers within the HIPAA timeline, no later than 60 days after discovery

HIPAA

Business Associate Agreements

When your agency stores protected health information in CareForce, we act as your business associate. We sign a standard BAA at no extra cost before you add that information.

There is no official HIPAA certification for software, and we do not claim one. To request a BAA, email support@careforce.cloud.

What we have not done yet

We would rather tell you now than have you find out in a security review.

Documents

Policies and disclosures

Found a vulnerability? Email security@careforce.cloud. We also publish a security.txt file.