Security
How Senior Care Intel protects your work
What is in place today.
In place today
Each item below is how Senior Care Intel works now.
| Control | How it works today |
|---|---|
| Encrypted connections | All pages and requests use HTTPS. |
| Passwords | Stored only as salted PBKDF2-SHA256 hashes. One-time set-up and reset links work once and expire after 7 days. |
| Session cookies | Sign-in sessions use an HttpOnly, Secure, SameSite cookie. Only a hash of the session token is stored. Sessions end after 30 days, or after 14 days unused. Suspending, resetting or deleting an account ends its sessions. Changes are accepted only from Senior Care Intel’s own pages (cross-site requests are refused). |
| Server-side permissions | Administration, imports and settings are refused by the server for customer accounts, even if the browser is altered. |
| Customer isolation | Each customer’s private work is stored in its own workspace. Tests sign in as two customers and confirm neither can read the other’s items. |
| Sign-in abuse limits | After 10 failed sign-ins from one network, or 10 for one account, in 15 minutes, sign-in is paused for 15 minutes. Password changes, exports, uploads and other costly actions have per-user limits too. |
| Backups | Team data (accounts, organizations, opportunities, notes, tasks, buyer models and uploaded documents) is copied automatically once a day and kept for 30 days. A full copy of everything is taken before each release. A full restore into a separate copy was tested on October 29, 2026: every table and row matched. |
| Browser protections | A strict content security policy, no framing by other sites, and no third-party scripts, trackers or fonts. The map view loads satellite images from a public map image service. |
| No keys in the browser | The browser never receives database or service credentials. |
| No patient data | Senior Care Intel is for business development. It does not collect resident or patient information, and forms ask you not to enter it. |
Your private work
Private by default
- Notes, lists, next steps, deal work and documents belong to the organization that created them
- No sharing across customers and no public indexing of private work
- Private work is not used to train models
Access by role
- Owner, Admin, Member and Viewer roles inside each organization
- Every change checked on the server against those roles
- Suspending an account ends its sessions at once
Report a security issue
If you believe you have found a vulnerability, send a description, the page or request involved, and steps to reproduce through the Contact page. Please don’t access other customers’ data, run load tests or use automated scanners against the service without permission.