Security

Each person has their own account. The sign-in token’s subject is that person’s id. Tables that hold an agency’s records force row-level security, and the application role cannot bypass it. A second agency cannot read those rows. Roles include owner, admin, scheduler, billing, caregiver, client, and nurse. A role that is not on a permission cannot use that action.

A caregiver opens a client’s chart when that caregiver has a shift that is not cancelled, or a visit, with that client. When an agency turns open shifts on, the text a caregiver receives does not include a client name, an address, or a Medicaid ID.

A family login is linked to one client. A visit note on that login appears only when the office has marked it shared. The clinical family view stays off until the office turns it on. That view shows a care-plan section, a visit note, or a goal only when the office has turned that piece on and a current family release includes the care plan.

Sign-in is a password plus an optional authenticator. An agency can require the authenticator for office roles. Authenticator secrets are encrypted with AES-256-GCM. An account locks after five failed passwords. Access tokens expire in 15 minutes. Refresh tokens can be revoked. A support session opened from the owner console lasts 30 minutes and is written to that agency’s audit log.

The audit log is append-only. The database trigger rejects updates and deletes. Reads of health information are written there. Metadata on an audit row is not allowed to carry names, email addresses, or Medicaid IDs.

The application is written for encryption in transit: TLS 1.2 or newer on the load balancer. The deployment templates do not give Postgres a public address. This page does not say a production database is already serving agencies. This page does not certify the product.

Questions about controls: security@aidenext.com. The website notice is Privacy.