Security and Responsible Disclosure

Caregiver Compass holds personal and often difficult information about caregiving. This page explains, in plain language, how we protect it and how to tell us if you think something is wrong.

No online service can promise perfect security, and we do not make that promise. What we can describe is the protections that are actually in place today.

Your account

You sign in with your own account. We never ask for your password by email or phone.
Caregiver Compass is invitation-only during the beta, so accounts are not created anonymously.
You can sign out of every device from your account settings.

Who can see your information

Every record is tied to the person it belongs to, and the database itself enforces those boundaries — not just the screens you see. One caregiver's records are not reachable by another caregiver.
People you invite into a Care Circle see only what that role allows, and only what you have chosen to share with them.
A small number of administrators can access limited account and support records to run the service, investigate a problem, or act on a request you make. Administrator access is role-based and recorded. Your conversations with Alma are excluded from that access.
Files you upload are kept in private storage, not on a public address.

Protection in transit and at rest

The site is served over an encrypted connection.
Our hosting and database platform encrypts stored data and manages backups on our behalf, under their own security programme.
Verification codes are stored in a hashed form, never as readable text.

Record-keeping and review

Significant actions in an account — a consent change, a deletion request, an administrator action — are written to a history that cannot quietly be rewritten.
We run automated checks against our database access rules and dependencies, and we review the results as part of our release process.
We do not claim continuous human monitoring, a certified security programme, or compliance certification under any specific regulation.

Alma and the services behind her

When you talk with Alma, your message is sent to an AI model service that produces the reply. When you use voice, your recording is transcribed and the reply may be spoken back to you.
Audio is processed for that turn and is not stored as an audio file in your account.
Those services process information on our behalf. The full list, and what each one is used for, is in our Privacy Policy.

How long we keep records

Records are kept for as long as they are needed to run the service, or as long as the law requires. Some technical and audit history is deliberately preserved so that a record of what happened remains. Our final retention schedule is still being reviewed with legal counsel, and this page will be updated when it is approved. Details of what is kept, and what is not, are in our Privacy Policy.

Reporting a security concern

If you believe you have found a security problem in Caregiver Compass, please tell us before telling anyone else, and give us a reasonable opportunity to fix it.

Email care@aicaregivercompass.com with the subject line "Security report", and describe what you found and how to reproduce it.
Please do not access, change, or download anyone else's information while testing.
Please do not run tests that could disrupt the service for caregivers who depend on it.
We will acknowledge your report and keep you informed. We do not currently operate a paid bug bounty.

If your account itself looks wrong — an unexpected sign-in, a change you did not make — contact us at care@aicaregivercompass.com right away. Correspondence reaches Oikos Consulting & Management Inc..

Emergencies

Caregiver Compass is not an emergency service. If someone is in immediate danger, contact your local emergency services. See Safety and Scope for what the app is and is not for.

This page describes our current practices. It is not a legal certification or a claim of compliance with a specific regulation.