Security Practices
Encryption in Transit — All communication between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS). Data is never transmitted in plain text.
Encryption at Rest — Your data — including all records, observations, uploaded documents, and photos — is encrypted at rest in our database and file storage systems. Encryption keys are managed separately from the data they protect.
Access Controls — Your data is strictly scoped to your household. No other user or household can access your records. Our API enforces household-level isolation on every request, and all data access requires an authenticated session.
Secure File Storage — Uploaded files — including photos, placement documents, and certificates — are stored in an encrypted object storage service. Files are never publicly accessible. Access requires a time-limited signed URL that expires after a short period.
Session Security — User sessions are managed server-side using encrypted session tokens. Sessions expire after a period of inactivity and are invalidated immediately on sign-out.
Audit Logging — Significant actions within your account — including record creation, document uploads, report generation, and account changes — are logged with timestamps and user identifiers for transparency and accountability.
AI Feature Data Handling — Text AI (tone coaching, quick capture, and voice note structuring) sends text to an AI provider only after server-side replacement. When you use AI on text you've written, our servers replace registered children's names, stored nicknames, dates of birth and identifiers, stored bio-parent contact names, and recognizable phone numbers and addresses before sending text to an AI provider. This can miss unregistered nicknames, unusual address formats, schools, places, and other identifying details. Leave out anything you don't want processed. Document and image scanning is temporarily unavailable while we rebuild it so child information is not sent to a third-party AI service. AI providers are contractually prohibited from training their models on your data. You can turn off server-side AI features in Account Settings; that setting does not control your device's dictation service.
Device Dictation — ResourceCareConnect does not record or transcribe audio. If you use keyboard or OS dictation, your device's speech service handles the audio; ResourceCareConnect receives the resulting text when you submit it.
Third-Party Data Processors
| Category | Purpose | Data Accessed |
|---|---|---|
| Payment Processing | Securely handling subscription payments and billing | Payment card data (not stored by us), billing email, subscription status |
| File & Document Storage | Storing uploaded photos, documents, signatures, and generated PDFs | Uploaded files, encrypted at rest |
| Transactional Email | Sending account confirmations, password resets, and notifications | Your email address and name |
| Cloudflare Web Analytics | Anonymous, cookieless page-visit statistics on public pages only; never on logged-in app pages | Public page path, referrer, and basic visit metadata; no child or household records |
| AI Text & Voice Note Structuring | Powering optional tone coaching, text quick capture, and voice note structuring features | Text and voice-note transcripts after server-side replacement of registered children's names, stored nicknames, dates of birth and identifiers, stored bio-parent contact names, and recognizable phone numbers and addresses. Unregistered nicknames, schools, places, and other identifying details may remain. |
| AI Document Scanning | Document and image scanning is temporarily unavailable while we rebuild it so child information is not sent to a third-party AI service | None while scanning is paused; documents uploaded for storage are not sent to this AI processor |
We do not use advertising networks, social media trackers, or data brokers. We do not share your data with DHS, courts, or government agencies unless required by law. This list is reviewed and updated regularly.
Breach Notification Commitment
In the event of a data breach affecting your personal information, we commit to: beginning internal assessment within 72 hours of discovery; notifying affected users by email within 30 days of confirmed breach; complying with Oregon's data breach notification requirements under ORS 646A.600–646A.628, including notifying the Oregon Attorney General when required.
Reporting a Security Issue
If you discover a security vulnerability in ResourceCareConnect, please report it responsibly by emailing support@resourcecareconnect.app. Please do not publicly disclose security issues before we have had a reasonable opportunity to address them. We take all reports seriously and respond promptly.