Security
How Senior Care Intel protects your work
What is in place today, what is planned, and what we do not claim.
In place today
Each item below is how Senior Care Intel works now.
| Control | How it works today |
|---|---|
| Encrypted connections | All pages and requests use HTTPS. |
| Passwords | Stored only as salted PBKDF2-SHA256 hashes. One-time set-up and reset links work once and expire after 7 days. |
| Session cookies | Sign-in sessions use an HttpOnly, Secure, SameSite cookie. Only a hash of the session token is stored. Sessions end after 30 days, or after 14 days unused. Suspending, resetting or deleting an account ends its sessions. Changes are accepted only from Senior Care Intel’s own pages (cross-site requests are refused). |
| Server-side permissions | Administration, imports and settings are refused by the server for customer accounts, even if the browser is altered. |
| Customer isolation | Each customer’s private work is stored in its own workspace. Tests sign in as two customers and confirm neither can read the other’s items. |
| Sign-in abuse limits | After 10 failed sign-ins from one network, or 10 for one account, in 15 minutes, sign-in is paused for 15 minutes. Password changes, exports, uploads and other costly actions have per-user limits too. |
| Backups | Team data (accounts, organizations, opportunities, notes, tasks, buyer models and uploaded documents) is copied automatically once a day and kept for 30 days. A full copy of everything is taken before each release. A full restore into a separate copy was tested on October 29, 2026: every table and row matched. |
| Browser protections | A strict content security policy, no framing by other sites, and no third-party scripts, trackers or fonts. The map view loads satellite images from a public map image service. |
| No keys in the browser | The browser never receives database or service credentials. |
| No patient data | Senior Care Intel is for business development. It does not collect resident or patient information, and forms ask you not to enter it. |
Planned before paid launch
Not built yet. Listed so nothing here is mistaken for a current control.
| Control | What it will do | When |
|---|---|---|
| Multi-factor authentication | Required for administrators, optional for other users | Milestone 2 |
| Verified account recovery | One-time links sent to a verified email | Milestone 2 |
| Owner, Admin, Member and Viewer roles | Enforced on every API, export and file link | Milestone 2 |
| Audit trail | Access-aware logs of sign-ins, exports and support access, with private fields masked | Milestone 6 |
| Private file handling | Signed private downloads, size and type limits, malware screening for uploads | Milestone 4 |
| Verification review | OWASP ASVS used as a checklist, plus a dependency and authorization-bypass review | Milestone 6 |
| Off-site backups | A scheduled full copy kept outside the hosting account, so recovery does not depend on it | Milestone 6 |
Your private work
Private by default
- Notes, lists, next steps, deal work and documents belong to the organization that created them
- No sharing across customers and no public indexing of private work
- Private work is not used to train models
What we do not claim
- No HIPAA compliance claim: Senior Care Intel is not built to hold patient data
- No SOC 2 or other certification, and no security badge
- No promise of perfect security or zero downtime
Report a security issue
If you believe you have found a vulnerability, send a description, the page or request involved, and steps to reproduce to [Security contact email — to be confirmed]. Please don’t access other customers’ data, run load tests or use automated scanners against the service without permission. Until that address is confirmed, use the Contact page and choose “Report a security issue”.