Built on trust. Secured by design.
Security isn't a feature we bolted on afterwards — it's how the platform is architected, from the database up. This page describes exactly what that means, in plain terms.
Tenant isolation at the database layer
Every table that carries organisation data is scoped by row-level security policies enforced inside the database itself, not just filtered by application code. A request that isn't scoped to your organisation returns nothing, by construction — the database refuses it before your code ever sees a row.
Role-based, permission-checked access
Every person is assigned one or more roles, and every role is built from an explicit permission catalogue — not a UI-only toggle. The same permission check that hides a button in the interface is enforced again, independently, by the function that actually performs the action.
A full audit trail
Security-relevant actions — sign-ins, invitations, role and permission changes, status changes to sensitive records — are written to an append-only audit log as they happen, reviewable by your own administrators.
Encrypted in transit
All traffic between your team's browsers and Comfort Care, and between Comfort Care and its own database, is encrypted end to end using TLS.
Secrets held in a dedicated vault
Third-party credentials (calendar, accounting, e-signing and payment connections you choose to enable) are encrypted at rest in a dedicated secrets vault, never stored as plain text, and scoped to your own organisation only.
Least-privilege by default
New roles start with no access. Every permission a role holds is one that was explicitly granted to it — access is opt-in, not something to remember to switch off.
What we don't claim
We don't hold a formal certification such as ISO 27001, and we're not CQC-certified ourselves — CQC registration applies to the care provider, not to us as their software supplier. Where the platform supports a provider's own CQC readiness (records, audit trails, role-based access), we say so specifically rather than implying a certification we don't hold. If you have a security questionnaire or need more detail for your own due diligence, get in touch and we'll answer directly.