Security at ConsidraCare

Our Approach

ConsidraCare is built for home care agencies, community health nonprofits, and field operations programs. The data these organizations work with is sensitive by nature, so security is not an add-on. It is part of how the platform is designed from the ground up.

Our security program is built around three ideas. Protect data at every layer, give customers visibility and control, and keep pace with the regulatory environments our customers operate in across Canada, the United States, and internationally.

Verified by Compliancy Group

ConsidraCare is actively monitored by Compliancy Group, a leading independent compliance partner trusted by healthcare and SaaS organizations across North America. Compliancy Group continuously verifies our compliance posture across both HIPAA and SOC 2 frameworks, ensuring our security and privacy controls are not just documented but actively maintained.

The badges below are issued and continuously updated by Compliancy Group. Click on either badge to verify our current monitoring status directly with them.

Compliance & Regulatory Alignment

In addition to ongoing monitoring through Compliancy Group, we design ConsidraCare to align with the regulatory frameworks that matter most to our customers across the markets we serve:

Infrastructure & Hosting

ConsidraCare runs on enterprise-grade Amazon Web Services (AWS) infrastructure. AWS is the same platform trusted by hospitals, banks, and government agencies, and it provides the foundation our security controls are built on.

• Hosted on AWS EC2 with hardened operating system images
• AWS data centers are SOC 1, SOC 2, SOC 3, ISO 27001, HIPAA, and PCI DSS certified
• Physical security, including biometric access controls, 24/7 surveillance, and environmental safeguards, is handled by AWS at the data center level
• Network isolation through Virtual Private Cloud (VPC) configuration
• Web application firewalls and AWS security groups filter traffic before it reaches our services
• DDoS protection at the edge via AWS Shield
• Automated patching and vulnerability management on all hosts

Data Protection

Access Controls

We follow the principle of least privilege, meaning people get access only to what they need to do their job, and no more.

• Role-based access control for customer-facing features, so admins, supervisors, field staff, and auditors each see only what they should
• Multi-factor authentication required for ConsidraCare employees accessing production systems
• Just-in-time access for sensitive operations, with approvals logged
• Quarterly access reviews to remove access for people who no longer need it
• Confidentiality agreements signed by every employee and contractor with access to customer data

Audit Logging & Monitoring

Every meaningful action inside the platform is logged, including record creation, edits, deletions, access events, and administrative changes. These logs are retained for a period appropriate to their type and are available to customers for audit and compliance purposes.

On the infrastructure side, we monitor our systems continuously for unusual activity, failed authentication patterns, and performance anomalies. Alerts route to our on-call team around the clock. Our compliance posture is also continuously verified through Compliancy Group’s monitoring program.

Secure Development

We build security into the development process, not around it.

• All code changes go through peer review before being deployed
• Automated security scanning runs on every pull request, including dependency checks and static analysis
• Secrets are never committed to source code and are managed through dedicated secret management tooling
• Separate environments for development, staging, and production, with production data never used in non-production environments
• Regular security training for engineering staff
• Third-party penetration testing as part of our roadmap, with results shared with qualified customers under NDA

Backups & Business Continuity

We back up customer data on a regular schedule, with backups encrypted and stored in a geographically separate AWS region from primary systems. Backup restoration is tested periodically so we know it actually works when it matters.

Our business continuity plan covers system outages, provider failures, and broader disruptions. Recovery time and recovery point objectives are defined per service tier and available on request.

Incident Response

If a security incident occurs, we have a defined process for detection, containment, investigation, and recovery built around HIPAA and SOC 2 requirements. If an incident affects your data, we will notify you without undue delay and within the timeframes required by applicable law. We will tell you what we know, what we do not yet know, and what we are doing about it.

If you believe you have discovered a security issue in our platform, please report it to privacy@considracare.com. We take every report seriously and do not take legal action against researchers acting in good faith.

Third-Party Vendors & Subprocessors

We work with a small set of carefully selected vendors to provide parts of the ConsidraCare service, including AWS for hosting, our email delivery service, payment processor, and analytics tools. Each vendor is reviewed for their security posture, data handling practices, and regulatory alignment before we use them. Our subprocessor selection is part of what Compliancy Group monitors as part of our ongoing compliance program.

A current list of our subprocessors is available on request for customers who need it for their own vendor management programs.

AI and Customer Data

Your Security Responsibilities

Security is a shared responsibility. While we protect the platform and the infrastructure, there are a few things you and your team should do:

• Use strong, unique passwords and enable multi-factor authentication
• Keep your access credentials confidential
• Remove access for employees or contractors who leave your organization
• Keep the devices and browsers you use to access ConsidraCare up to date
• Report anything suspicious to us so we can investigate