CareHelm

Security and data handling

What we do today to protect your records, and what is still planned. The full detail is in our Privacy Policy and Data Processing Addendum.

Where your data is stored

  • Your business data, staff records, incident records and files are stored in Google Cloud's Sydney region, australia-southeast1, using Cloud Firestore, Cloud Storage for Firebase and Cloud Functions.
  • Sign-in runs on Google Firebase Authentication, which processes sign-in in the United States.
  • Emails are sent by Resend from Japan (Tokyo). Once an email is sent, the address and content are removed from our database.
  • Our website and app use Google Analytics. We send it no names, email addresses, typed answers, or participant or staff details.

The list of service providers shows what each one receives and where.

Who can see your data

  • Each organisation's data is kept separate by database security rules. Automated tests check these rules.
  • Roles: Owner, Admin and Staff. Staff see only their own documents.
  • Two-step verification with an authenticator app is available for every account.
  • Each organisation has an audit log of changes and administrative actions.
  • Only authorised Data Nebula staff can access production systems, and only when needed for support or security. Our support console shows them account contact details, and none of your policies, evidence, incident records or staff records.
  • A read-only auditor link shows your requirements status, published policies, evidence list and files, and register counts. You can revoke it at any time.

Encryption

Data is encrypted in transit with TLS and at rest with Google Cloud's default encryption.

Files and exports

  • An audit pack includes a manifest with the SHA-256 checksum of every file, so you can show nothing changed after export.
  • An Owner or Admin can download all your data from Settings at any time: records as CSV files, your uploaded files and your policies as PDF. The download link works for 7 days, then the file is deleted.
  • Audit packs and other export files are deleted from storage after 30 days. Voice recordings are deleted once transcribed, and after 1 day at most.

AI processing

Some features use third-party AI services to write drafts and suggestions. They receive only the content the task needs and process it outside Australia. We don't use your data to train AI models, and in the live service we use AI services only under terms that stop them from using your content to train their models. Our separate test environment is for test data only. AI output is always a draft that you confirm. Details are in section 6 of the Privacy Policy.

Backups

We do not keep separate backups today, so download your data regularly. If we start keeping backups, we will update this page and the Privacy Policy.

If something goes wrong

We have a written data breach response plan. We act straight away to contain and assess a suspected breach, within 30 days at most. If a breach is likely to cause serious harm, we notify the people affected and the OAIC, as the notifiable data breaches scheme requires. If it affects data you put into CareHelm, we tell you within 72 hours. Details are in section 11 of the Privacy Policy and our Data Processing Addendum.

Report a security concern

Email privacy@carehelm.com.au.

Certifications

CareHelm does not hold ISO 27001 or a similar certification today. Our hosting provider, Google Cloud, publishes its own certifications.

Last updated 18 October 2026.