What is protected, and what has not been done yet.

What is protected

• Separate organisations. Every request is limited to the signed-in person's own organisation. Nothing is shared between them.
• Roles. Staff see policies and their own record. Managers and administrators also see who has read what.
• Sign-in. Passwords are stored only in one-way scrambled form, with at least 12 characters. Emailed links work once, last 15 minutes, and cannot be used up by email scanners. Repeated wrong attempts are slowed down. Sessions end after 2 hours of no activity.
• The pages. Secure connection only, forms that cannot be forged, a policy that forbids scripts from anywhere else, and text that is rebuilt from a short list of allowed formatting.
• Files. Checked by content, kept under random names, served only to people in the organisation. Macros are refused.
• Sharing with other systems. Read-only keys that an administrator makes and can revoke at once, stored only in scrambled form, limited to published content unless a key is explicitly given the reading permission, with every key creation and revocation logged.
• The record. A published version and a confirmation cannot be changed or deleted from within Policy Core, and an activity log records who did what.

What is not collected

No advertising or analytics tools, no third-party scripts, no tracking of the pages you look at, and no care or health information about the people your organisation supports. One cookie keeps you signed in.

What has not been done