Security and data protection

Children's records deserve engineering, not reassurance

This page describes how Nurtalo is actually built: where separation is enforced, how access is decided, what is written to an audit trail, and what we deliberately do not claim.

Ask a security question Read the privacy notice

What we do not claim

No badge wall. We do not list certifications, accreditations or audit reports we do not hold. If a claim is not on this page, assume we are not making it.
No uptime figure. The service is pre-launch, so any availability percentage would be invented.
No perfect-security promise. We describe controls and how we fail closed, not an assurance that nothing can ever go wrong.

Audit trail

History is written, not reconstructed afterwards

Sensitive changes in Nurtalo are appended rather than overwritten. A medication entry that was wrong stays in the record with the correction written beside it, carrying the author, the time and the reason. When you are asked months later what happened, the answer is read out of the system rather than assembled from memory and email.

Corrections are new entries, so the original remains readable
Every entry carries an author, a timestamp and the setting it belongs to
Reading person-level detail from group level is itself recorded
Export produces the same history you can see on screen, in a portable format

Ask a security question

Separation

Tenancy is enforced in the database

Every record has an owner

Records belong to an organisation and, where relevant, a setting
Membership records decide access, and they live on the server
Nothing a browser can edit is ever treated as authority
Role claims in user metadata are never used to authorise anything

Row-level security everywhere

Row-level security is enabled on tables exposed to the data API
Policies are tenant-aware and scoped to membership
Grants are least-privilege rather than blanket table access
Cross-tenant reads are refused by the database, not by the interface

Privileged operations are separated

Elevated keys never reach the browser or client bundles
Sensitive workflows run as tightly scoped server functions
Where a database function is privileged, it re-checks the caller
Support-style actions require their own reviewed design and audit

Files are private by default

Product file storage is private, with tenant-aware rules
Downloads are bound to the record they belong to
Public marketing imagery is kept entirely separate from product media
Document scanning is implemented as a reviewed boundary before it is enabled

Accountability

What is recorded, and what that gets you

Immutable audit

Sensitive actions are appended as events rather than overwriting a row
Events carry actor, time and the record they concern
History is kept so a question months later has an answer
Audit is a base capability, not an upgrade

Versioned decisions

Consent wording is versioned and decisions reference a version
Policies are versioned with acknowledgement coverage
Statutory qualification decisions are reviewed and evidence-backed
Corrections are recorded as corrections, keeping the original

Honest state

Queued, submitted, approved and shared are distinct and labelled
Unknown is never displayed as a reassuring green
Receipts state audience and server state, not just success
Offline shows an offline page rather than stale records

Data rights

Full organisation-wide export is a base capability
Data rights requests are modelled as a tracked process
Retention and deletion are handled deliberately, not ad hoc
The export broker is a reviewed boundary rather than an open endpoint

Accounts

Signing in, and staying signed in safely

Authentication

Sign-in uses a standards-based, cookie-backed authorisation-code flow
The server re-derives identity from the request on every call
Password recovery is a distinct, restricted session state
Return destinations are validated against an approved route map

Accessible for the people actually using it

WCAG 2.2 AA treated as the working minimum, checked as we build
Full keyboard operation with a clearly visible focus indicator
Minimum 44 x 44 pixel targets on every product action
Status never communicated by colour alone
Readable at 200% text size, and respects reduced-motion preferences

Questions

From data protection leads

Do you hold ISO 27001, Cyber Essentials or similar?: We are not claiming any certification on this page. If we hold one in future it will be named here with its scope and date, and not before.
Where is data stored?: Hosting and processing details are set out in the written proposal and the data processing terms for your organisation, so that they are accurate and contractual rather than a marketing sentence.
Can Nurtalo staff read our children's records?: Ordinary application access follows the same tenancy rules as any other account. Privileged support access requires a separate reviewed design with its own immutable audit, and is not a casual capability.
How do you handle a security report?: Send it through the contact page and describe the issue rather than including any personal data. We would rather receive a rough report early than a polished one late.

Have a specific security requirement?

Send us the question, or the section of your due-diligence pack, and we will answer it precisely rather than generically.

Contact the team Privacy notice