Security
The controls, stated plainly.
CareTrack holds other people's patients' medical and financial records. This page describes controls that exist in the product today — and says where we are on certification, because an unsupported badge is the claim a security questionnaire catches first.
Controls
Six that decide everything else.
A separate database per company
Not a shared schema with a tenant column. Each customer's business data lives in its own Postgres database, created when the company is onboarded. A query written without a company filter cannot return another customer's rows, because those rows are not in the database the request is connected to.
Authorization decided by policy, at three levels
A dedicated policy engine answers whether this principal may take this action — on the route, on the individual record, and on a list, where the policy is compiled into the query so a caller never receives rows they may not see. A caller who names a record outside their reach is refused rather than handed a silently empty list.
Clinical detail is a separate grant
Being able to open a case does not mean being able to read the patient's diagnosis, allergies or medication. Plenty of people who legitimately work a case have no reason to read a diagnosis, and the platform treats that as the default rather than the exception. Timeline entries about a clinical update name the fields that changed and never their values, so the timeline cannot become a way around the grant.
Every mutating request is audited
Actor, action, outcome and a correlation id, stored in the company's own database. The correlation id ties one user action to every log line it produced, which is the difference between an audit trail and a list of events.
Credentials are sealed and never returned
Mailbox tokens are encrypted with AES-256-GCM and no endpoint returns them — the read path names its columns explicitly, so a column added later cannot start leaking from an endpoint nobody revisited. The control plane stores the hash of an in-flight authorization token and never the token, so reading it yields nothing that works.
Separation of duties on money
Preparing a payment and releasing it are different grants, and the platform refuses an approval from the person who prepared it — a control that is enforced rather than merely granted, because every administrator holds both grants. No bank account details are stored anywhere in the platform.
Data handling
The questions your assessor will ask.
Answered here so you can start the assessment before you talk to us.
- Where does our data live?
- In a Postgres database created for your company alone, on infrastructure in a single named region. Documents live in object storage under the same account.
- Can CareTrack staff read our cases?
- Platform staff can see operational facts about your account — whether your mailbox is connected, for instance — and cannot connect one on your behalf and are not granted your company's business permissions. Connecting a mailbox hands over a standing credential to years of patient names and insurer negotiations, so it sits on the same grant as changing your registered address, and it stays yours.
- What happens to correspondence if we disconnect a mailbox?
- The connection is revoked at the provider and routing stops. The correspondence already filed against your cases stays where it is.
- Is patient clinical data sent anywhere?
- A guarantee of payment travels to a third party's shared inbox and carries the patient's name and date of birth and no clinical information at all. Domain event payloads carry no patient identifiers alongside financial amounts, deliberately — that is the payload that ends up in a log line.
- How is a company's data isolated in backups and restores?
- A restore targets one company's database. There is no operation that restores one customer by rewriting a table other customers share.
Certification
What we have not earned, we do not display.
CareTrack is not currently certified against ISO 27001, SOC 2 or HITRUST, and we will not display a badge we have not earned. What we can do is answer a security questionnaire against the controls above, walk your team through the authorization model, and give you a written data-processing description for your own assessment.
Bring your security questionnaire.
We would rather answer it against the real authorization model than send you a datasheet. Walk the policy engine, the tenancy boundary and the audit trail with our engineers.
Or email contact@sthiramtechnologies.com