Security and data protection

Children's records deserve serious engineering

Nurtalo holds some of the most sensitive records a family will ever share. This page describes how the system is built, in plain terms, without claiming certifications or audits we have not completed.

Ask a security question Read the privacy notice

Architecture

How access is decided

Authorisation is a server-side decision derived from membership records. A URL, a form field or anything a user can edit is never treated as authority.

Tenant isolation

Every record belongs to an organisation and a setting
Access derives from organisation and site membership records
Row-level security is enabled on every table holding your data
Cross-tenant access is denied by the database, not merely hidden

Least privilege

Explicit, narrow grants rather than blanket table access
Writes go through checked procedures, not open table updates
Elevated keys stay server-side and never reach a browser
Safeguarding sits apart from everyday child records

Files and media

Photos and documents are stored privately, never publicly readable
Access uses short-lived links generated for a verified request
Links are bound to the record they belong to
Multi-child media respects every family's permissions

Accountability

Sensitive actions are recorded with actor and timestamp
History is kept rather than silently overwritten
Operational logs are immutable once written
Full data export is a base capability

Behaviour

Honest state is a security property

Software that overstates what has happened is unsafe in a nursery, whatever its encryption story.

No false confirmations

Queued, submitted, approved and shared are distinct states, and Nurtalo shows the real one. Unknown is never presented as fine.

No stale personal data

Authenticated pages are always fetched from the network. Offline shows an offline page rather than yesterday's records from a cache.

No accidental exposure

Multi-site oversight withholds person-level detail unless your scope allows it, rather than aggregating everything by default.

Status

Where Nurtalo currently stands

Nurtalo is pre-launch and in active development. The security properties described above are how the system is built and tested today. We do not currently claim any third-party certification, and we will not imply one until it exists and can be evidenced.

If you are evaluating Nurtalo and need detail beyond this page — data location, sub-processors, retention, breach handling or your own due-diligence questionnaire — ask us directly and we will answer specifically rather than in marketing language.

If you believe you have found a security issue in Nurtalo, please contact us before disclosing it publicly so we can investigate and fix it.

Bring your due-diligence questions

We would rather answer a hard security questionnaire early than discover a mismatch after your setting has moved its records.