Care data deserves serious protection.
You are trusted with people’s health, homes and families. Here is how AlphaOmega helps you keep that trust — and evidence it to inspectors.
Defence in depth
Layered, not bolted on
Security is part of how every screen is built: what a user can see is decided by their role and organisation on the server, never just hidden in the browser.
- Least-privilege roles
- Server-side permission checks
- Per-organisation data
- Session controls
Controls
What’s in place today
Hosted in the UK
The platform and its data run in AWS’s London region, so care records stay in the UK.
Encrypted in transit
Every connection — browser and carer app — travels over HTTPS.
Two-factor authentication
Staff can turn on two-factor sign-in: a one-time code from an authenticator app on top of the password.
Hardened sign-in
Passwords are stored only as salted hashes, and repeated failed attempts are throttled.
Role-based access
Carers, coordinators, managers and admins each see only what their role needs.
Organisation isolation
Each provider’s data is separated by organisation, and branches can be kept apart within one.
Audit trail
Changes to key records are logged with who made them and when — ready for inspection.
Locked-down carer app
An app lock screen protects client details if a phone is lost or left unattended.
Security headers
Pages refuse to be framed, block content sniffing and keep sign-in tokens out of referrers.
UK GDPR: you stay the controller
For the care records you keep in AlphaOmega, your organisation is the data controller and we act as your processor — on your instructions, for your purposes. Carers, clients and families asking about their data are directed to you. Our privacy policy sets out exactly what we hold, why, and for how long.
Read the privacy policyReport a security vulnerability
If you think you have found a security problem in the AlphaOmega website, web app or carer app, email hello@alphaomegatech.co.uk with what you found and how to reproduce it. We will acknowledge your report within 5 working days and keep you updated until it is fixed.
- Only test against your own account, and stop as soon as you can show the problem.
- Do not access, change or keep other people’s data, and never use real care records as test data.
- No denial-of-service testing, social engineering or physical attacks.
- Give us a reasonable time to fix the problem before telling anyone else about it.
If you report in good faith and follow these rules, we will not take legal action against you.
Have a security questionnaire to fill in?
Send it over. We’ll answer it properly, and walk your team through how access and data work in practice.
- Onboarding and data import done with you
- Carer app for iOS and Android
- UK-based support from people who know care