Security & Trust
Built to protect resident data
NutriCare handles sensitive health information for aged-care residents. Security and privacy are designed in from the database up, not bolted on. This page summarises the controls in place today and where we are heading.
How we protect your data
Australian data residency
Resident health records are stored in a managed PostgreSQL database hosted in Australia (Sydney, ap-southeast-2). Application compute runs in the same Sydney region.
Encryption in transit and at rest
All traffic is served over HTTPS with HSTS enforced (HTTP is redirected to HTTPS). Data is encrypted at rest by the managed database (storage and backups), with additional application-level encryption on MFA secrets and selected sensitive fields.
Multi-tenant isolation
Every query is scoped to a single organisation and site. As defence in depth, PostgreSQL Row-Level Security denies direct data access at the database layer across all tables, not just in application code.
Role-based access control
A 10-role hierarchy enforces least privilege, so each staff member sees only what their job requires. Access is checked on every request, server-side.
Tamper-evident audit trail
Every data change is recorded in an append-only audit log. Records are insert-only at the database level and cryptographically hash-chained, so any attempt to alter or remove history is detectable.
Account security
Passwords are hashed with bcrypt. Sessions are short-lived, accounts lock after repeated failed logins, cookies are hardened, and sensitive actions are rate-limited by IP.
Application hardening
A Content-Security-Policy, clickjacking and MIME-sniffing protections, server-side input validation, and parameterised database queries guard against common web attacks.
AI privacy controls
AI-assisted features are optional per organisation: an administrator can opt the tenant out of sending any health information to our AI provider. Every AI query is recorded in the audit trail.
Privacy and compliance
NutriCare is designed to align with the Australian Privacy Principles (Privacy Act 1988) and the Notifiable Data Breach scheme. Personal information is minimised, access is logged, and records follow a 7-year retention standard appropriate for healthcare, with soft deletion so nothing is lost prematurely.
We are transparent about where data goes. Health records stay in Australia; the subprocessors we rely on are listed below.
Certifications and roadmap
We believe in being straight about our stage. NutriCare aligns with the Australian Privacy Principles and is working toward the ASD Essential Eight. We do not yet hold formal certifications, and we will not claim ones we do not have.
On our roadmap as we scale: an independent penetration test by a certified firm, a documented Essential Eight self-assessment, and formal certification (ISO 27001) when the business supports it. We are happy to share our current posture and answer a security questionnaire during procurement.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage (resident health records) | Australia (Sydney) |
| Vercel | Application hosting and content delivery. Does not store health records. | Sydney compute; global edge network |
| Anthropic | AI features (optional, per-tenant opt-out available) | United States |
| Resend | Transactional and report email delivery | United States |
Report a vulnerability
If you believe you have found a security issue, we want to hear from you. We handle sensitive health information for aged-care residents and take every report seriously. Email us with the details and we will acknowledge your report within 3 business days.
What to include
A clear description of the issue, the steps to reproduce it, the affected URL or endpoint, and the potential impact. A proof of concept helps us confirm and fix it faster.
Scope
In scope: the NutriCare application and API at nutri-care.app. Out of scope: volumetric denial-of-service, social engineering of our staff or customers, physical attacks, spam, and reports from automated scanners without a demonstrated, exploitable impact.
Please do not
Access, modify, or delete data that is not your own, degrade the service for others, or publicly disclose the issue before we have released a fix. If you encounter another tenant's resident data during testing, stop and tell us immediately.
Safe harbour
We will not pursue or support legal action against researchers who act in good faith, follow this policy, and give us a reasonable opportunity to resolve the issue before any public disclosure. Thank you for helping us keep residents' data safe.