Security

Every record belongs to one agency, and our database enforces that itself, using row level security. Even if there were a mistake in our app’s code, the database would still refuse to show one agency’s records to another. Each member of care staff can only ever see their own records.

• Invite only. Nobody can join an agency without an invite from one of its managers. Invite links work once and run out after 7 days.
• Two step sign in for managers. A password and a 6 digit code from an authenticator app, so a stolen password alone is not enough.
• Strong passwords, stored in scrambled form so nobody at Checked and Ready can read them.
• Protection against guessing. Repeated failed sign ins are slowed down and blocked.
• Separate address for the app. Sign in only happens at app.checkedandready.com, and its cookies never leave it.

Certificates are kept in private storage, never on a public web address. When someone allowed to see one opens it, we create a link that stops working after a few minutes, so a copied link is useless. Files are checked for type and size when they are uploaded.

• All traffic uses HTTPS, and browsers are told never to connect without it.
• Data is encrypted when stored, including backups.
• Agency records are stored in the UK, on Supabase servers in London.
• Our website sends strict security headers that block common attacks such as clickjacking.

• Our own admin area is hidden, needs two step sign in and records every action in a log that cannot be edited.
• We only look at an agency’s records when they ask us to help, and only as much as needed.
• Secret keys are never stored in our code, and each service gets only the access it needs.

If we discover a breach that affects your agency’s records, we will tell you without undue delay, with what happened and what we are doing about it, so you can meet your own duties. We report to the Information Commissioner where the law requires. Updates appear on our service status page.

If you think you have found a security weakness, please email hello@checkedandready.com with the word Security in the subject. Please do not access other people’s data or disrupt the service while testing. We will reply within 2 working days and keep you updated while we fix it.