Security overview
How ElderCareLog protects care data
Families use ElderCareLog for private caregiving information, so the product is designed around least-privilege access, environment separation, and careful monitoring.
Access control
Authorization is enforced in Postgres with row-level security. Each care circle has member roles and permission flags for health, documents, legal and financial records, and circle administration. UI checks improve clarity, but database policies are the source of truth.
Application architecture
The web app is a static Next.js application hosted on Vercel. Server-side actions run in Supabase Edge Functions, and scheduled work runs through Supabase-managed jobs and functions. Production and staging use separate Supabase projects and credentials.
Data protection
Traffic is encrypted in transit. Document storage is access-controlled by circle permissions. Error reporting is scrubbed to remove health text, names, emails, notes, and URL query strings before events leave the browser.
Responsible disclosure
If you believe you found a security issue, email help@eldercarelog.com with a description and reproduction steps. Please do not access, copy, or share data that does not belong to you.