How we protect your documents

In place today

Every route checks permission on the server, not in the browser. Hiding a button is a tidiness measure; it is not access control, and nothing here relies on it.

Asking for an order that belongs to somebody else returns “not found” rather than “not allowed”. The difference matters: “not allowed” confirms the record exists, which is itself a disclosure — it tells a stranger that a particular reference number is real.

Staff permissions are granular rather than a single administrator flag, and a family circle is a boundary in the data: siblings in different countries share one view because they were added to it, not because the software failed to separate them.

In place today

Every privileged action writes an audit record naming who did it, what changed from and to, when, and the reason they gave. That record joins the same database transaction as the action, so an action that was rolled back cannot leave a trail claiming it happened.

A refused action is recorded the other way round, on purpose: it commits on its own. When the outcome is a refusal, joining the transaction would erase the one row worth keeping — the record that somebody tried.

Money has a second control on top of the trail. A refund is requested by one person and approved by another, the same person cannot do both, and no payment provider is called until the approval commits.

Planned, not yet built

The intent is that every document opened — by anyone, for any reason — writes a row recording the staff member, their role, the time, the order it related to, the reason, and the network address it was opened from, and that you can read that list for your own documents.

Today that happens for documents attached to an order’s checklist and not for everything else. The record type exists and is written from one path; extending it to every read, and showing it to you, is the work that remains.

Until then, do not read “every access is logged” anywhere on this site as covering every document. The privileged-action trail above is the part that is real.

In place today

• A new file is held unreadable and unattachable until it has been through the scan gate. It cannot be opened, downloaded or linked to an order while it waits.
• A file that fails is moved out of the servable area rather than deleted, and every order it was attached to is unlinked. It is kept because an infected upload is evidence — somebody either has a compromised machine or is attacking the family they share a vault with, and destroying the only copy destroys the ability to know which.
• The storage path is built by the server. Only the file name comes from you and it is reduced to a flat token, so a name crafted to escape the storage area does not.
• Every version stores a cryptographic hash of its contents, so a file that was altered or replaced underneath the record is detectable rather than silently wrong.
• Uploads are capped at 20 MB. Scans are documents, not archives.

Planned, not yet built

The application sends the browser instruction that forces every future visit to this site onto HTTPS, refuses to let the browser second-guess a file’s declared type, trims what is leaked in referrer headers when you follow a link away, and switches off camera and microphone access for the page entirely.

What is not yet done is the half that lives outside the application: the certificate and protocol policy at the edge, the redirect from plain HTTP, and an encrypted, certificate-verified connection between the application and its database. Those are deployment configuration and this deployment has not had them applied.

Planned, not yet built

Uploaded files are currently written to ordinary disk storage without a layer of encryption of our own, and the sensitive fields that are designed to be stored as ciphertext — a document’s number, a person’s allergies, medications and medical notes — are not yet encrypted either.

The intended arrangement is database, snapshot and file storage all encrypted under a key we control, an explicit permission required to decrypt a sensitive field, a masked value returned to anybody without it, and a record written every time a decryption is refused.

This is the single largest gap on this page, and it is the reason the wording elsewhere on the site was corrected rather than left standing.

Planned, not yet built

The intended arrangement is that no storage area is publicly readable, that a download is reached only through a signed link that stops working within five minutes, that a replayed expired link is refused by the storage provider before it reaches us, and that file contents never pass through the application server.

Files are served from local storage through the application today, so none of that is in force yet. Sharing a document outward is likewise not built: the ability to expire and revoke a share is designed and recorded in the data model, and nothing enforces it, so there is no customer-facing share link to rely on.

In place today

When a link is pasted into a messaging app, that app fetches the page — signed out — and reads the title, description and image it advertises. Any page holding an order, a document, a family or a person publishes none of those, and asks search engines not to index or follow it.

The pages that may be shared are an explicit list rather than a list of exclusions. A new route is unshareable until somebody deliberately adds it, so forgetting is safe in the direction that matters.

Planned, not yet built

The design is a named retention period for every class of data with a stated reason — financial records for the statutory eight years, visit evidence for a period after the order closes, call recordings for far less — computed when a record is created from the policy in force at that moment, and a nightly job that removes both the record and the stored file when the period ends and writes down what it removed.

A record under legal hold is skipped rather than purged, and a forced deletion of one is refused. Evidence keeps its ledger entry when its contents are purged, so a purge reads as a purge rather than as a gap in the chain.

The fields this depends on exist on the evidence records. The schedule and the job that acts on it do not yet, so nothing is being deleted on a schedule today. To ask for your data, or for its deletion, see the privacy policy.

In place today

This site sets what it needs to keep you signed in and to remember your theme, language and timezone. There is no advertising network on it and no third-party analytics script.

A consent banner asks once, on your first visit, and it defaults to that necessary set alone. Refusing everything optional is a single click sitting beside accepting it, and nothing beyond the strictly necessary set is set or sent before you have chosen. See the privacy policy for what each purpose covers and how long an answer is kept.

In place today

If you have found a way to reach data you should not, tell us before you tell anybody else and we will not pursue you for having looked. Please include what you did, what you saw, and roughly when.

A dedicated disclosure address has not been published yet — this deploy has no NEXT_PUBLIC_SECURITY_EMAIL set. Until it is, use the routes on the contact page and say in the first line that it is a security report, so it is escalated rather than queued.