Security & data handling

Your compliance records can name the children in your care. Here is exactly how we handle them.

Where your documents live

• Uploaded documents are stored in a private storage bucket (Supabase, built on AWS infrastructure). Files are never publicly accessible — access requires your authenticated session.
• Every database row is protected by row-level security: your account can only ever read your own documents and reports. No other centre can see your data, and we don't have a general “browse everything” view into customer documents in the normal course of operating the product.
• Data is encrypted in transit (TLS) and at rest, per our storage provider's platform defaults.

AI processing

• Analysis runs on Claude, an AI model provided by Anthropic, via Anthropic's commercial API.
• Your documents are not used to train AI models. Anthropic's commercial API terms exclude API inputs and outputs from model training by default.
• Reports never name a child.Our analysis references records by date and type — “the daily record for June 12” — never by a child's name, even though the source documents themselves may contain names. Personal information about children stays inside your private, stored source documents; it does not appear in report output or share links.

Deletion

• Delete a check and its documents anytime from your dashboard — this is a hard delete: the files are removed from storage, not just hidden from view.
• Delete your entire account by emailing us — we remove your profile, all checks, all documents, and all reports within 7 days.

Sharing

• Report share links use unguessable tokens and are read-only.
• A share link exposes the report only — never your source documents, and never a child's name (the report doesn't contain any, by design).
• Anyone with a share link can view that one report. Don't share a link if you don't want that report seen by whoever has it.

Cross-border data

Your documents and reports are stored in Canada (AWS Canada Central, Montreal). During analysis, document content is sent to Anthropic's AI service in the United States for the duration of the check, and our web application is served by Vercel, whose servers may process requests in the United States. Data processed in the United States may be subject to that country's laws, including lawful access by its courts or authorities. See the Privacy Policy for more detail.

If something goes wrong

If we ever discover a security incident affecting your data, and it creates a real risk of harm to you or the people named in your documents, we'll notify you and, where the law requires it, the Office of the Privacy Commissioner of Canada, without unreasonable delay.

Questions

Email katie@centrecheck.ca— you'll get an answer from the founder.