The page your IT team will ask for.

01Data residency & hosting

CarePoint is hosted on Australian infrastructure. Resident, clinical and administrative data does not leave the country.

• Sovereign hosting. Primary production infrastructure runs in Australian data-centre regions only.
• No cross-border replication of resident health information or PII.
• Australian-owned. CarePoint EMR Pty Ltd is an Australian company, governed by Australian law.
• Network controls. Production access is restricted by IP allow-listing, role-based access, and short-lived credentials.
• Time synchronisation via NTP for accurate timestamps across the audit log.

02Architecture & tenancy

Each facility operates as an isolated tenant. Tenant identity is enforced on every database read and write, not just at the application layer.

• Per-facility tenant isolation at the data-access layer — a query without a valid tenant context cannot return data.
• Facility-specific subdomain per tenant, with tenant-scoped session tokens.
• Defence in depth — application checks, ORM-level filters, and database-level scoping all enforce the boundary.
• No shared production credentials between tenants.
• Graceful shutdown ensures in-flight writes complete cleanly across deployments.

03Authentication & access

Authentication follows current OWASP guidance. Authorisation is role-based, with action-level granularity and a facility-controlled permission editor.

Password hashing

Argon2id with per-user salts and parameters tuned for current best-practice memory and time cost.

Password policy

Minimum length and complexity enforced server-side, with known-compromised password rejection on creation and reset.

Session management

Server-validated session tokens, configurable inactivity timeout, immediate revocation on logout or role change.

Account lockout

Progressive rate-limiting and lockout on repeated authentication failures.

Login telemetry

Each login event captures user, timestamp, IP and user-agent — available to facility administrators for review.

SSO / SAML / 2FA

2FA available for administrative roles. SSO/SAML for multi-site operators on the roadmap — contact us for status.

Authorisation model

Action-level role permissions across every module. Roles, permissions and dashboard scope are configurable in-app by facility administrators. Family-portal accounts use a separate, read-only authentication flow.

04Encryption

Resident data is encrypted in transit and at rest, with managed keys held within Australian infrastructure.

• In transit: TLS 1.3, modern cipher suites, HSTS enforced. HTTP traffic redirects to HTTPS at the edge.
• At rest: AES-256 encryption applied to the production database, backups, and uploaded file storage.
• Key management: Managed by the underlying infrastructure provider's KMS, with key rotation policies in line with industry best practice.
• Secrets management: Application secrets stored outside the codebase in a managed secrets service — never in source control.
• Certificate management: Automated renewal with monitoring on expiry.

05Audit & monitoring

Every clinically or administratively significant action is recorded. The audit log is a first-class feature, not a compliance afterthought.

• Action-level audit — create, update, delete and export events captured against the authenticated user.
• Filterable by user, resource, date range and action type from inside the admin panel.
• CSV export for accreditor or legal review.
• Configurable retention in line with your facility's data-handling policy and Aged Care Act record-keeping requirements.
• Structured logging with request IDs for traceable incident response on the application side.
• Authentication telemetry — every login, logout, password change, and role change is logged.
• Tamper resistance — audit records are append-only from the application; modification requires direct production database access by authorised engineers.

06Backups & disaster recovery

CarePoint backs up production data continuously, retained for a defined window, with documented recovery objectives.

Backup cadence

Continuous transaction-log backups with daily full snapshots.

Retention

Daily snapshots retained for 35 days. Longer-term archive available on request.

Recovery Point Objective (RPO)

≤ 15 minutes for production database.

Recovery Time Objective (RTO)

≤ 4 hours for a full-region failover scenario; typically minutes for partial recovery.

Restore testing

Backup restoration tested on a regular schedule against a non-production environment.

Backup encryption

AES-256 at rest, stored within the same Australian residency boundary as production.

07Regulatory alignment

CarePoint is built specifically for Australian residential aged care — so the regulatory framework isn't an afterthought, it's the design brief.

• Aged Care Quality Standards — clinical documentation, audit, restrictive practice records and review cycles are designed to support all eight Standards.
• Aged Care Act & record-keeping requirements — resident clinical record retention with configurable lifecycle policies.
• SIRS reporting — Priority 1 (24h) and Priority 2 (30d) workflow with deadline tracking and notification drafting.
• National Quality Indicators (NQI) — 14 indicators with availability tracking, benchmark comparison and ACQSC-compatible export.
• AN-ACC — suggested classification from validated assessment scores; care-minute tracking against funded target.
• Privacy Act 1988 — handling of personal and sensitive information in line with the Australian Privacy Principles (APPs).
• Notifiable Data Breaches scheme — incident response procedures aligned to OAIC notification timelines.
• Restrictive practices — signed authorisations, behaviour support plans, consent capture, and review scheduling.

08Vulnerability management

We harden the platform continuously — at the code, dependency and infrastructure layers — and welcome responsible disclosure.

• Dependency scanning on every commit with prioritised remediation for high and critical findings.
• Static analysis (SAST) in CI flagging OWASP Top 10 patterns and secret leakage.
• Server-side input validation on every endpoint — bad data is rejected, not stored.
• Common-vulnerability mitigations for SQL injection, XSS, CSRF, SSRF, IDOR and request smuggling.
• Patch SLAs — critical CVEs patched within 72 hours; high within 7 days.
• Penetration testing on a defined cadence and on material architecture changes; reports available under NDA.
• Responsible disclosure — email security@carepoint.com.au. We acknowledge within one business day and coordinate disclosure timing with the reporter.

09Subprocessors

A short, deliberate list. Every subprocessor handles data inside Australian residency boundaries.

Cloud infrastructure

Australian-region cloud provider for compute, storage, database and backup. Australian residency contractually enforced.

Email & transactional notifications

Australian-compliant email provider for password resets, family-portal notifications and administrator alerts.

Error monitoring

Application error capture with PII scrubbing — only stack traces and request metadata, never resident health information.

Static asset delivery

Stylesheets, scripts and brand imagery only. No PII or PHI is delivered via CDN.

A current, named list of subprocessors with addresses and processing purposes is available to customers and prospects under NDA — email security@carepoint.com.au.

10Data rights & export

Your data is yours. We make that operational — not just contractual.

• Full data export available in machine-readable formats (CSV, JSON) at any time during the agreement.
• Documented schema for exported data so it can be re-imported into another system if needed.
• End-of-contract data return within a defined window, with secure deletion confirmation thereafter.
• Resident-level export for discharge, transfer or legal request — including the full audit trail.
• No re-use of customer data for product analytics, marketing or model training without explicit opt-in.
• Australian Privacy Principles (APPs) alignment for collection, use, disclosure, access and correction.

11Incident response

Documented playbook, named responders, defined notification timelines.

• Severity classification on detection — sev-1 (data exposure or platform-wide outage), sev-2 (significant degradation), sev-3 (limited impact), sev-4 (informational).
• Customer notification commences immediately on sev-1 confirmation. Status updates at minimum hourly until resolution.
• Notifiable Data Breach — assessment within 72 hours of detection; OAIC notification within the statutory window where eligible.
• Post-incident review shared with affected customers within 10 business days, including root cause and remediation.
• Direct line to the team that built the platform — incident response isn't outsourced.