Security & trust

Data residency

Customer data is stored and processed within the United Kingdom and European Economic Area. No customer data is transferred outside the UK / EEA in normal operation. A full list of sub-processors is available to customers under a signed Data Processing Agreement.

Encryption

All data in transit is protected with TLS 1.2 or higher. All data at rest is encrypted with AES-256. Sensitive columns containing financial or personal payout details receive additional column-level encryption.

Multi-tenancy

Every customer-scoped table has Row Level Security documents tied to the authenticated user's organisation. A query that escapes our server-side checks still cannot read another tenant. Server-side gateway code is the primary access control; RLS is defence in depth.

Cross-tenant isolation is tested in our CI pipeline — we run pgTAP tests that intentionally try to read across tenants and assert they fail.

Authentication

Customer staff authenticate per-tenant: each organisation's users live in their own auth context, accessed only via that org's subdomain. Multi-factor authentication is available for any account and enforced for platform admins. SAML/OIDC SSO is available for enterprise accounts on request.

Audit trail

Every state change writes to an append-only audit log: actor, before / after snapshots, IP, user agent. Published policy versions are immutable. Acknowledgements record the exact version a member confirmed, with timestamp and IP — so when an inspector asks “what was the policy in March?”, the answer is unambiguous.

Backups & resilience

Point-in-time recovery is enabled on the database. We maintain off-site backups and run a documented restore drill on the production database before launch and quarterly thereafter.

Compliance

Carex32 is registered with the Information Commissioner's Office as a data controller. We hold a base Cyber Essentials certificate and are working through Cyber Essentials Plus before launch. Our Data Processing Agreement template is available on request — we'll countersign it before you go live.

Responsible disclosure

Found a security issue? Email hello@carex32.co.uk with reproduction steps. We'll acknowledge within one working day. We don't currently run a bug bounty program but recognise good-faith research in our acknowledgements.