Skip to content
CordoCare.
Find your plan

Security, privacy & control

Trust deserves
the details.

Your practice holds sensitive information. Know where records live, who can access them and what happens when you need help.

Read the full privacy policy
Australian practice hosting.Considered access.
Clear service boundaries.Explore the controls ↓

Australian practice hosting. Clear service boundaries.

Practice records and uploads are stored on CordoCare-operated servers in Australia. AI, payments, email and web delivery providers may process information overseas. Review the privacy policy before sending sensitive information through a particular workflow.

Data Protection & Infrastructure

CordoCare runs on its own servers in Australia, with encrypted disks, encrypted backups and restricted administrator access.

  • CordoCare-operated servers in Australia with encrypted (LUKS2) disks
  • Encrypted backups taken frequently, with restores tested
  • Privacy controls designed to support Australian providers
  • Customer workspace access and infrastructure administration have different controls

Encryption

Encrypted connections, encrypted server disks and encrypted backups protect information in transit and at rest.

  • HTTPS connections to the application
  • Database connections use TLS 1.2 or higher
  • Encrypted (LUKS2) server disks for the database and files
  • Encrypted database backups

Role-Based Access Control

Granular permissions ensure team members only access what they need. Seven built-in roles with organisation-unit scoping.

  • Owner, Admin, Manager, Finance, Coordinator, Therapist, and Viewer roles
  • Participant-level access restrictions
  • Organisation-scoped data isolation
  • Invitation-only team onboarding

Audit Trail

Recorded changes and approved in-app support requests identify the actor and time. The organisation audit log can be filtered and exported; it is not a complete log of every ordinary record read or infrastructure access.

  • Recorded application changes and approved support-session activity
  • User and timestamp recorded on every entry
  • Relevant before-and-after values where supported
  • CSV export of the audit trail

NDIS Compliance

Built to align with NDIS Practice Standards and Quality and Safeguards Commission requirements.

  • Case note compliance tracking
  • Incident, risk, and feedback registers
  • Worker screening tracking
  • Evidence collection for audits

Customer-Approved Support Access

An organisation owner or administrator confirms a named support person using a code sent to their account email. The session uses the approving person’s role, expires automatically and can be revoked.

  • Read-only access by default, with explicit approval required for changes
  • Time-limited approval for one named support person
  • Organisation owners and administrators notified on confirmation and first access
  • Support requests and denied changes recorded in the organisation audit log
  • Privileged hosting, database and backup access remains a separate boundary

Data Retention & Deletion

Retention and deletion depend on the record type and applicable requirements. Removing a participant from normal access does not immediately erase related evidence or backups.

  • Participant removal and permanent erasure are separate operations
  • Deletion requests require authority and a review of retained evidence
  • CSV export available before account closure
  • Participant anonymisation for right-to-erasure requests

Release Verification and Recovery

Production changes use checks tied to the release revision, migration rehearsal and encrypted recovery snapshots. These technical checks do not establish ISO certification or a SOC 2 audit opinion.

  • Application and database checks before deployment
  • Migration rehearsal before production schema changes
  • Fresh encrypted database and storage recovery snapshots
  • Deployed version and health verification

These controls do not establish ISO certification or a SOC 2 audit opinion. Software can support your governance work; your organisation remains responsible for its obligations.

Need a specific security answer?

Bring the questions that matter to your practice. We’ll walk through the records, notes and billing with you.

Request a walkthroughCompare plans and start a trial

No account or card needed to request a walkthrough.