Enterprise-grade security, with care-sector defaults
Sponsor licence data is sensitive by its nature — passport numbers, visa details, right-to-work checks and salaries. Here is how AuditReady.care looks after it for care providers across the UK.
Mandatory two-factor authentication
Every admin user must enrol a TOTP authenticator (Google Authenticator, Microsoft Authenticator, Authy, 1Password) before they can access the platform. Enforced in middleware — there is no opt-out.
UK / EU data hosting only
Data is stored in Supabase's London (eu-west-2) region on encrypted Postgres. Backups stay in the same region. No US, no third-country transfers.
Tenant isolation at the database
Every table enforces Row Level Security tied to your organisation's tenant_id. A Home Manager at care group A cannot read anything about care group B — the rule is applied by Postgres, not by application code.
Automatic session timeout
Any inactive session is signed out after 20 minutes with a two-minute countdown warning. Works even when the browser tab has been backgrounded on a phone.
Invite-only user creation
New users are invited by email via Supabase Auth. Passwords are never emailed. The invited person chooses their own password on first login and is walked into 2FA enrolment before any real data is visible.
Full audit log
Every meaningful action — worker created, document uploaded, role changed, SMS report confirmed — is written to an immutable audit log with the actor, timestamp and payload. Available on request for regulator scrutiny.
Architecture & hosting
AuditReady.care is a modern web application built on Next.js and Supabase, deployed on Vercel. Application and database live in the UK / EU: Vercel edge nodes in the UK region and Supabase Postgres in London (eu-west-2). All traffic is served over TLS 1.2+.
Access control
Users belong to a single tenant (your organisation). Within that tenant a role is assigned — Home Manager, Compliance Manager, Admin, Super Admin, or Owner. Sensitive actions such as adding a user, deleting a worker record or exporting an audit pack are permission-gated. Every such action is written to the audit log.
Row Level Security
Every table in the database has a tenant_isolation RLS policy that filters rows by the current session’s tenant. The policy is enforced by Postgres itself — application code does not have the option to bypass it. In practice, this means a compromised or misbehaving client-side query cannot leak data from another tenant.
Authentication
Authentication is handled by Supabase Auth. Passwords are hashed with bcrypt. Two-factor authentication (TOTP) is mandatory for every admin user; the middleware redirects any unauthenticated or aal1 session before an authenticated route resolves. Session tokens are short-lived JWTs, refreshed silently, and revoked on sign-out.
Email delivery
Transactional emails (invitations, password resets, support notifications, lead alerts) are sent via Brevo from noreply@audit-ready.care. Our sending domain has SPF, DKIM and DMARC configured. Recipients are limited to the named parties for each message; no marketing broadcasts are sent from operational addresses.
Backups & retention
Database backups are taken daily by Supabase and retained in the same UK/EU region. Point-in-time recovery is available for the last seven days. Deleted records enter a soft-delete state (archived) before permanent removal so that accidental deletion is recoverable.
Data subject rights (UK GDPR)
We act as a data processor on behalf of your organisation, which is the controller of its workers’ personal data. You can export a full CSV or per-worker audit pack at any time from within the platform. Requests for erasure or portability under UK GDPR are actioned within 30 days — contact your Account Owner or email sales@audit-ready.org.
Data Processing Addendum (DPA)
A standard UK GDPR-compliant DPA is available on request. Most care groups sign this alongside the service agreement. Contact us for a copy.
Incident response
We monitor deployments, database performance and error rates in real time. In the unlikely event of a personal-data breach that affects your organisation, we notify your Account Owner within 72 hours in line with UK GDPR obligations, together with a summary of scope, root cause and mitigation.
Third parties
We use a small, deliberate set of sub-processors. All are covered by the DPA:
- Supabase — Postgres database, authentication, object storage (London, UK).
- Vercel — Next.js hosting and edge network (UK / EU regions).
- Brevo — transactional email delivery.
- Cloudflare — DNS and DDoS protection.
Questions?
Send security or procurement questions to sales@audit-ready.org and we’ll respond within one working day.