Security & trust
The most sensitive data a family will ever hand over.
Medical histories, legal agreements, payment schedules, and the identities of everyone involved in creating a child. Here is how it is held, who can reach it, and what we refuse to do with it.
Encrypted in transit and at rest
TLS on every connection, encryption at rest on the database and on stored documents. No unencrypted copy of a medical record exists anywhere in the system.
Isolated per agency
Each agency’s data is separated at the database layer, not filtered in application code. A query written for one agency cannot reach another’s families.
Access by role, not by trust
A coordinator sees the cases they carry. A viewer cannot edit. An admin cannot silently read a portal conversation without it appearing in the trail.
Who can see what
Four audiences on one record, each seeing only their part.
A surrogate and an intended parent share a journey but not a view of it. Each person sees exactly their share, every time, without a coordinator having to think about it.
Visibility is set per document and per message, not per folder — so a medical record shared with a clinic does not become visible to everyone who can see the case.
The refusals
What we will not do with your data.
Four things we have decided against. These cannot quietly change once you have signed.
We do not hold anyone’s money
Payments are tracked against milestones and never processed here. Escrow, transfers and card handling stay with the people licensed to do them.
We do not train models on your families
Your data is not used to train anything, ours or anyone else’s.
We do not put our brand in front of your clients
The portals are yours end to end — your name, your address, your colours. Your clients never learn we exist, and we never contact them for any reason.
We do not sell, share, or analyse across agencies
No benchmarking product built from your book, no aggregate data sold on, no “industry insights” from other people’s families.
The audit trail
Every action, attributable.
Who did what, when, and what it changed — recorded on the case as it happens. When a family, a lawyer or a regulator asks how a decision was reached, you hand over a record.
This matters most at exactly the moments it is hardest to reconstruct: a match that was declined, a clearance that expired, a payment that was queried.
Where we are still building
The part a security page usually hides.
We are a young platform. Some of what procurement will ask for is in place and some is not. Here is which is which.
In place today
- Encryption in transit and at rest
- Tenant isolation at the database layer
- Role-based access and per-item visibility
- Append-only audit trail on every action
- One hosting region: Dublin, EU (Vercel dub1, Supabase eu-west-1)
- Translation, summaries and drafting run on a model provider under contract; your data is not used to train it, and every call is written to an audit table you can read
- Every sub-processor named, and the optional ones yours to switch off
Not yet in place
- SOC 2 Type II — not yet certified; audit not yet begun
- Third-party penetration test — not yet commissioned
- Customer-managed encryption keys — planned for licence agreements
- HIPAA BAA — not yet offered; ask us and we will tell you where it stands
If your procurement process needs something not listed here, ask. We would rather tell you we do not have it yet than discover the gap together during an onboarding.
Send us your security questionnaire.
We will fill it in properly, mark honestly what we do not yet have, and tell you where the rest stands. No security theatre.