Security and trust

How we keep Care Hub and your information safe

FSD Care Hub is the system FSD Care uses to run our NDIS services. It holds sensitive information about participants, families and staff, so this page sets out exactly how we protect it. We only list what is true today, and we update this page when that changes.

Last reviewed 1 November 2026.

Two-step sign-in for everyone. Every staff and family account needs a password and then a code from an authenticator app, or a one-time backup code. A password alone never opens any records, and there is no "remember this device", so every sign-in asks for a code.
No public sign-up. Every account is created by invitation. A manager can suspend someone's access, which signs them out everywhere at once.
Breached passwords refused. When a password is set or changed, it is checked against a list of passwords exposed in data breaches. Only the first 5 characters of a scrambled version (a hash) of the password are sent for the check, never the password itself. Passwords must be at least 12 characters.
Bot check and limits. The sign-in and "forgot password" forms use Cloudflare Turnstile to make automated attacks harder, and sign-in attempts are limited for each network address.
New-browser alerts. When an account signs in from a browser it has not used before, we email the account holder with the time and browser, so they can tell us if it was not them.
Sessions end after 12 hours. However active you are, you sign in again with your password and code after 12 hours.

Protecting records

Only what your role needs. One shared permission table decides what each role can see and do, and some decisions are kept for the Director alone.
Records stay with their provider. Each Care Hub setup serves one provider, with its own database. Every record also carries its organisation, nothing sent from a browser can change which organisation you are working in, and automated tests check, for most parts of Care Hub, that another provider's records cannot be seen or changed.
Tax file numbers are encrypted. Each tax file number is encrypted (AES-256-GCM) before it is saved, with a key that is never stored in the database. Only the last three digits are normally shown. Seeing the full number is limited to a few roles, needs a reason, and is recorded every time.
A tamper-evident audit log. Care Hub records sign-ins, account changes, and opening or changing sensitive records such as health details, incidents, progress notes, medications and worker files. Each entry is signed and linked to the one before it, so a changed, removed or inserted entry breaks the chain, and the database refuses to edit or delete entries. A daily checkpoint is kept in separate storage.
Documents are kept, not deleted. Documents are stored privately with no public web address. They open only for a signed-in person whose role allows it, and every view and download is recorded. Care Hub has no delete button for documents: they are archived with a reason, and every earlier version is kept.

Connections and the website

Encrypted connections. Care Hub and this website use HTTPS, and tell browsers to always use it.
Locked-down pages. Both send security headers that stop other sites from showing them inside their own pages and limit what a page can load.
Protected sign-in cookies. Sign-in cookies only travel over HTTPS, only to Care Hub's own address, and cannot be read by page scripts. Care Hub refuses any change that does not come from its own web address.

Where information is stored

Care Hub's information is stored with Cloudflare in the Oceania region. This is a placement hint we chose when setting it up, not a legal guarantee, and Cloudflare is a US company that may handle requests in its data centres outside Oceania.

Our database runs on Cloudflare D1, which keeps a point-in-time history we can use to restore it to an earlier moment if something goes wrong.

Services we use

These are the outside services that handle information for Care Hub or this website.

Cloudflare (US company, data placed in Oceania): hosting, database, file storage, logs, the bot check, and the emails Care Hub and this website send. If the optional voice notes are switched on, Cloudflare also turns speech into text.
Anthropic (US company, processed in the United States): AI features, only if the Director switches them on, feature by feature. Before text is sent, Care Hub replaces the names of people it knows, phone numbers, email and street addresses and identifying numbers with placeholders.
Xero: only if a provider connects its own Xero account. Care Hub then sends it the provider's invoices and who pays them, records payments against them, and sends pay runs if the provider uses Xero for payroll.
Have I Been Pwned: receives only the first 5 characters of a password hash when a password is set or changed, never the password or who it belongs to.
Google Fonts: the Care Hub app loads its typefaces from Google, which sees your IP address and browser type.

If you turn on phone notifications, your browser's own push service carries them in a form it cannot read. We do not use advertising, analytics or tracking services.

Certifications

ISO 27001: preparing. We are putting in place the security policies, risk assessments and reviews that an ISO 27001 audit needs. We do not hold the certificate, and we will only say so here once an accredited auditor issues it.

Report a security problem

If you think you have found a security problem in Care Hub or this website, please email careteam@fatsendisability.com with "Security" in the subject. Tell us what you found and how to see it. Please do not access, change or delete information that is not yours, and give us a fair chance to fix the problem before telling anyone else. Our contact details are also in our security.txt file.

Your privacy

Our privacy policy explains what we collect, why, and how to see or correct your information. Your wider rights are in our rights and responsibilities.