Security

Infrastructure

CareTrack runs on hardened cloud infrastructure with network segmentation, firewalls, and regular patching. Production environments are separated from development. Data at rest and in transit is protected using industry-standard encryption.

Access control

Role-based access limits staff, family, and administrator permissions. Multi-factor authentication options and OAuth sign-in reduce credential risk. Access to production systems is restricted to authorized personnel on a need-to-know basis.

Application security

We follow secure development practices, dependency monitoring, and testing. User sessions are protected against common web vulnerabilities. AI features require human review before casework outputs affect families, as described in our privacy documentation.

Monitoring and incident response

Audit logs track significant actions. We maintain incident response procedures including breach notification to customers and authorities under GDPR Articles 33–34 where applicable.

Compliance and subprocessors

Subprocessors are assessed and bound by data protection agreements. We support customers with DPIAs and GDPR compliance documentation on request. Finnish and EU data protection requirements are considered in vendor selection and data location decisions.