Security Practices and Beta Limits

Version 1.3 · Last updated: 2026-09-28

Security Practices and Beta Limits

Effective date: September 27, 2026

CareCircle handles sensitive mental health information. The following describes measures visible in the current code and the gaps still tracked for beta. A code control is not proof that every production path or device has passed an independent assessment.

Measures in place

  • Account sign-in is passwordless: a passkey (Face ID, a fingerprint or a device PIN) or a single-use code emailed to the account address that expires after five minutes. Care professionals must use a passkey, which is their second factor. Sessions can be revoked.
  • The web application has server-side route protection, role checks, request rate limits for web authentication, HTTPS, HSTS, Content Security Policy, and other security headers.
  • Backend functions check identity and practice boundaries for protected operations. Access is intended to be limited to authorized practice users and invited clients.
  • Service providers are listed in Subprocessors. CareCircle maintains an incident-response and manual rights-request process.

Limits and work still open

  • The current beta involves US hosting or processing. The planned Canadian sovereign VPS for the Next.js app and self-hosted Convex backend is not yet deployed or verified.
  • What is end-to-end encrypted. Chat messages and photos, and clients' journal entries, habit names and notes, personal notes, AI chat history and activity names, are encrypted on the person's device with keys that CareCircle's servers do not hold, so the servers store only encrypted content. A client can share an individual journal entry with a clinician, which gives that clinician the key to that entry only. Hydration and sleep values, habit goals and completions, timestamps, and who talks to whom stay readable to CareCircle so reminders, streaks and weekly summaries work. Video calls, clinical records kept by a practice, session notes, invoices and appointments are not end-to-end encrypted; they rely on access controls and transport security. If a client loses both their recovery code and every device, nobody can recover their encrypted data, including CareCircle. The encryption design has not yet had an independent security review.
  • Production authentication, video, mobile, and security-header paths still need complete end-to-end acceptance. Sign-in rate limits for the mobile app and other direct callers still share one bucket.
  • Clients have self-service export (a ZIP kept 7 days) and account deletion (after a 30-day cancellable grace period), and a daily job purges expired exports, sessions, and one-time security records. Practice owners have an audit-log viewer with CSV export. Professional and Practice exports and deletions, deletion of a clinical record, and a retention schedule for audit logs are still manual under Data Safety.
  • OpenAI calls exist in the code, while separate practice and client opt-in gating is not yet verified. AI chat history is stored end-to-end encrypted, but to answer, a client's recent AI messages are sent to OpenAI for processing. AI journal summaries are turned off. Do not use the AI feature with identifiable clinical content until that control is in place.
  • CareCircle has not obtained a SOC 2 report or certification and does not claim HIPAA compliance. No statement on this page is a certification of compliance with PIPEDA, Law 25, PHIPA, or PIPA.

Report a vulnerability

Send a concise description and safe reproduction steps to Nicholas Ponari, Data Privacy Officer, at nicholas@ponari.ca. His postal address is 5150 Rue Buchan, Montréal, Québec H4P 0A9, Canada. Mark an active incident “Security incident — urgent” and use any direct support channel supplied to your Practice as well. Do not send patient data in an ordinary email, publicly disclose the issue before coordination, or access data that is not yours. We will acknowledge a received report within five business days and work with the reporter on an appropriate resolution.