Trust centre
Security
A plain description of the architecture and the controls, written for the person who has to sign the supplier questionnaire.
Architecture
Kindround runs on the Cloudflare developer platform: Workers serve the API and every server-rendered screen, D1 is the primary database, R2 holds documents and photos, and scheduled jobs run the safety sweeps. Transactional email is sent through Resend. The sub-processor list is the complete list.
Data residency and encryption
Database and storage location hints are set to Western Europe with EU jurisdiction and the choice is recorded. All data is encrypted in transit (TLS 1.2 or higher, HSTS preloaded) and at rest by the platform. Signed file links expire in ten minutes.
Tenant isolation
Every table carries the provider's tenant id and every index leads with it. One query helper injects the tenant predicate; hand-written SQL outside the data layer fails the build. A session whose tenant differs from a row it touches is refused, logged and counted as an attack.
Access control
Roles are defined in code as a ceiling nobody can exceed. Restrictions stored in the database can only narrow. A route the model cannot place is denied. Administrators cannot update or delete a check-in, a medication administration, a timeline entry or an audit row.
Authentication
Office sign-in by email and password (PBKDF2, 100 000 iterations), optional two-factor for managers and mandatory for administrators from phase two. Carer devices hold a random 256-bit token bound to the user, device and tenant, protected by a PIN; three failures force a full sign-in, ten wipe the device cache, and a device unseen for 60 days is revoked. Failed sign-ins are audited.
Audit and monitoring
Every write records the actor, their role at the time, the timestamp, and before and after values. Reads of sensitive panels are logged. Watch rules run every ten minutes for failed sign-in bursts, permission changes, off-hours administrator writes and any personal-data export, and raise a flag for review.
Backups and recovery
Nightly export to separate storage, 35 daily and 12 monthly copies, an integrity manifest for append-only tables, and a restore drill before go-live and quarterly after. Recovery point objective 24 hours; recovery time objective eight working hours; both tighten after go-live.
Vulnerability disclosure
Report a suspected vulnerability through the contact form with the topic set to security. We acknowledge within two working days and do not pursue researchers who act in good faith.