Trust & Security Center™
How My Castle Care thinks about security, governance, and privacy — and the practices we follow to protect the organizations and members who depend on us. This page describes our current capabilities and clearly marks future objectives.
This page describes platform practices and planned objectives. It does not represent certifications, regulatory approvals, or compliance achievements that have not been obtained.
Our security philosophy
Protecting sensitive care information is a responsibility we take seriously. These principles guide how we design, build, and operate the platform.
Care comes first
Security measures exist to protect people — never to get in the way of safe, timely care.
Protect by default
Access is narrow by design; information is shared only with those who need it.
People are part of the system
Roles, training, and accountability matter as much as technology.
Honest about where we are
We distinguish current capabilities from future objectives — no overstatement.
Governance approach
Governance is built into the platform through roles, permissions, and oversight — not added as an afterthought. Below, current capabilities are marked separately from future objectives.
Role-based access
CurrentAdmin, supervisor, provider, and client roles each see only what their role requires.
Authentication
CurrentAuthenticated sessions protect access to the platform and its data.
Audit trails
CurrentKey administrative actions are logged for review and accountability.
Formal security certifications
Future objectivePursuing recognized independent security and compliance attestations.
Privacy practices
Privacy is about showing the right information to the right people — and nothing more. We separate what the platform does today from what we are working toward.
Least-privilege access
CurrentEach user sees only the records relevant to their role and assignments.
Private document storage
CurrentUploaded documents are stored privately and accessed through time-limited signed links.
Access logging
CurrentViews and downloads of private files are recorded for accountability.
Data retention & deletion policies
Future objectiveFormal, documented data retention and deletion schedules.
Designed to Be Dependable
These describe platform capabilities and design intent, not service-level guarantees.
Scalable Architecture
A platform structure designed to grow alongside your organization and user base.
Centralized Administration
Unified configuration, user management, and oversight across the platform.
Multi-Site Support
Coordinate multiple locations with role-scoped data and consolidated visibility.
Disaster Recovery Planning
Backup and restore capabilities support continuity and responsible preparedness.
Performance Monitoring
Operational awareness helps maintain a responsive, dependable experience.
Continuous Improvement
The platform evolves through ongoing refinement and customer-informed development.
Security controls
A mix of platform-level, application-level, and administrative controls. Current capabilities are distinguished from future objectives — we won't claim what we haven't yet achieved.
Hosted platform
CurrentThe platform runs on managed cloud infrastructure with platform-level protections.
Private file storage
CurrentSensitive documents are stored separately from public assets and gated by signed URLs.
Account lock controls
CurrentAdministrators can lock accounts to preserve audit history without deleting records.
Backup & restore
CurrentAdministrators can create and restore system backups for recovery.
Encrypted backups to cloud storage
FutureAutomated, encrypted off-platform backup snapshots.
Independent penetration testing
FutureRegular third-party security assessments.
Built for Human Services
Each organization remains responsible for meeting its own regulatory and licensing obligations.
Where we are, and where we're going
Trust is earned by being honest. Here is a transparent view of what is in place today, what is coming next, and what we are working toward.
- Role-based access
- Private file storage
- Audit & access logging
- Account lock controls
- Documented data retention policies
- Encrypted off-platform backups
- Enhanced session security
- Independent penetration testing
- Recognized security attestations
- Formal compliance audits
"Next" and "Ahead" items are objectives, not commitments or achieved certifications.
Our commitment
We will protect the organizations and members who depend on us — and we will be honest about where we are on that journey. This page will evolve as our practices and attestations grow.