Your residents’ data, protected by design
Care records are special-category data under UK GDPR — the highest tier. CareBackOffice is built to treat them that way.
Security built into the platform
Your data kept separate
Every organisation’s data is isolated in the database itself, not just in the application. Automated checks confirm no data can cross between customers.
Secure sign-in
Passwords are stored as strong one-way hashes, repeated failed attempts lock the account, password strength rules are enforced, and sessions can be revoked instantly.
Right people, right homes
Role-based permissions mean staff see only what their role allows — and managers see only their own homes.
A complete audit trail
Every change records who did what, and when — attributable, contemporaneous and enduring. The accountability evidence UK GDPR expects.
Encrypted in transit
All traffic uses HTTPS, with modern browser security protections applied to every response.
GDPR tools built in
Subject access requests produce a password-protected export of everything held about a resident. Discharged residents can be anonymised, while financial records are kept for the required retention period.
Your data is always yours
A one-click export gives you your whole business — whenever you want it, including if you ever leave.
Cyber Essentials Plus
We’re working towards Cyber Essentials Plus, the UK government-backed certification in which an independent assessor tests our security controls. We’ll update this page when certification is complete.
Questions about security?
We’re happy to talk through how CareBackOffice handles your data, or answer your due-diligence questions.