Security and privacy
Buyers, program leaders and staff who need a plain account of security controls
Role-based access, multifactor sign-in and timely deactivation
Every screen and every data request checks the signed-in role again on the server. A hidden button is never the only control, and access follows the smallest set of screens and records the job needs.
Role-based access
Administrators, supervisors, advocates, case managers, partner staff, reporters and survivors each get a different role. Staff see cases assigned to them, their program, or the on-call queue. Partner staff see only referrals sent to their agency. Reporters see de-identified counts.
Multifactor sign-in
Staff and administrators sign in with a MAJIC account and multifactor authentication. Survivors reach the program through a safe link with a PIN or access code, so device possession alone never opens confidential information.
Timely deactivation
An administrator can suspend or deactivate a person and remove access at once. Past entries stay attributed to that person in history, but the deactivated account cannot sign in or be chosen for new work.
What each role can and cannot see
- Advocates and case managers work in assigned cases and programs. They can open, edit and refer within those cases, and they cannot see other programs unless their role allows it.
- Supervisors can view team queues, reassign open work, review duplicates, revoke consents and approve merges. Every merge keeps its reason and history.
- Partner staff see only referrals addressed to their agency, in lists, detail and exports. They never see other agencies referrals or a full case folder.
- Reporters see de-identified counts for VAWA and VOCA reports and exports. They do not open case notes, messages or names.
- Survivors see only their own visits, messages, forms and referral status. An account is always optional and every task is also reachable by secure link.
Lists, notifications, page titles, email subjects and audit detail follow the same rule. They show only a neutral case reference and never a survivor name, service detail, note text or access code.
Encryption in transit and at rest, audit trails, backups and incident steps
Protection covers the connection, the stored record and the history of what happened to it.
How data is protected
- Data is encrypted in transit between the browser and the server and encrypted at rest in storage, including backups and stored files.
- Every create, change, view of a full record, consent change, referral share, export and account change writes an audit entry with the actor, the action, the time and the record reference only.
- Audit detail never carries survivor names, note text, message content or secret values. Supervisors can review the trail by person, date and action.
- Backups are stored as part of the hosted environment, and recovery steps are tested before pilot. Exports are logged with who ran them, for which period and for what stated purpose, and they expire after a short download window.
- Audio and video service sessions are not recorded and recording and transcription controls stay off. Any monitoring or analytics feature must be disclosed with its controls before use.
If something goes wrong
Incident steps are agreed in the contract and the security documents. In plain order, the team contains the issue, assesses what was affected, preserves the audit trail, restores service from backup where needed and notifies the program owner through the agreed route. Staff do not put survivor detail in incident notes or in general project or chat tools.
A case folder, protected by a shield. Staff see only the records their role allows.
Consent, retention, United States hosting and how to request security documents
Consent decides what may be shared. Retention and hosting decide where records live and for how long.
Consent checks first
A referral cannot send personal fields unless an active consent covers that receiving agency, that scope and that date. Expiry and revocation take effect at once and block new sharing. Past sharing stays in the audit history.
Retention and deletion
The program sets retention for each record type. A new consent supersedes the old one and is never edited in place. Closed cases are read-only except for a dated correction. Test records are flagged as test and excluded from grant counts.
United States hosting
All work is performed by personnel physically located in the United States. All development, testing, staging and production environments, including backups and logs, are hosted in the United States, and access from outside the United States is prohibited.
What to ask for before you sign
This page states only controls built into the product. It does not list certifications that have not been earned. Ask for the current security documents through the demo form and share only organization contact details. Do not send survivor details in that request.
- The hosting and access disclosure, including any vendor, subcontractor or third-party access to program data, and the controls that prevent access from outside the United States.
- The backup, recovery and incident steps agreed for the contract, including how the program is notified and how a restore is demonstrated.
- The retention and deletion schedule for each record type, the export and transition plan at contract end, and the data dictionary for every reported field.
- The accessibility test approach and known limits, and the training and support steps for each role.
The program controls its data. At contract end, a complete export with the dictionary and checklist is provided so the program is not locked to one vendor. Identifiable records are never placed in general project or collaboration systems that are not approved for confidential client information.
Plain answers for IT and compliance review
Can a partner agency see referrals sent to another agency
No. Partner staff see only referrals addressed to their agency, and only the fields the consent allows. That limit applies in lists, detail, messages and exports.
What happens when consent is revoked or expires
New sharing stops at once. The referral send is blocked, and staff must ask for a new consent that covers the agency, scope and date before sharing again. The signed original and past sharing stay in the audit history.
Do notifications reveal survivor details
No. Notification text, email subjects, text previews, push previews and page titles carry no survivor, program or case detail. They say only that a message or visit is waiting and point to the secure link.
Are service sessions recorded
No. Audio and video service sessions are not recorded, and recording and transcription stay off. Notes are written separately by staff and are never copied into notifications or audit detail.
How are grant counts protected
Reports show de-identified counts only, with no names, addresses, phone numbers, emails, dates of birth, notes or message content. Unique participant counts use the program unduplicated identifier, and small groups that could identify a person are suppressed or grouped.
Review the controls with your team
Ask for the security documents and a guided demo with sample records.