Privacy by design, not by policy
I-Carenet is built so raw data stays in storage you control, access is provably scoped, and every action is on the record. Here's exactly how.
Private by architecture
Only metadata lives in your database. Every event payload lives in your own S3-compatible object storage and is reachable only through short-lived presigned URLs — buckets are never public.
Hard tenant boundaries
Organizations are a hard boundary — no data crosses orgs. Role-based access separates global Admins from org-scoped Investigators.
Modern auth
Strong password hashing with short-lived access tokens and refresh. Mobile devices authenticate with credentials minted from one-time enrollment codes — no passwords on the phone.
Two stores, one of them is yours
The split is deliberate: the platform holds the index, you hold the data.
- Metadata (campaigns, participants, schedules) lives in a database you operate.
- Event payloads upload directly to your S3-compatible object store in gzipped batches.
- Objects are reachable only via time-limited presigned URLs — the API never proxies raw data.
- Uploaded HTML activity bundles are verified with a SHA-256 hash before they run.
- Point at any S3-compatible object storage by changing environment variables only.
Prove who agreed to what — and honor a deletion request
Compliance workflows are first-class, with the records to back them up.
Versioned e-consent
Authored in Markdown. Publishing a new version re-gates every participant until they re-accept on the phone, with acceptance records (who, when, which device) per version.
GDPR deletion workflow
A REQUESTED → ACKNOWLEDGED → COMPLETED / REJECTED queue. Completion revokes the subject's devices; a rejection can issue recovery enrollment codes.
Full audit log
Every staff and system action — actor, action, entity, status and time — recorded, filterable and retained.
Self-host it, on your terms
Deploys with Docker. The production setup hardens the rest.
TLS by default
TLS is terminated for you in the production setup.
Internal-only datastores
Your database and object storage aren't exposed to the public network.
Nightly backups
Scheduled nightly backups keep your metadata recoverable.
Storage portability
Point at any S3-compatible object storage without touching code.
Want the security details for your IRB?
We'll walk your team through the architecture, end to end.