Last Validated: June 2026
At MapMyCare, we understand that handling sensitive health, behavioural, and safeguarding data for vulnerable young people requires the absolute highest standard of security. Our architecture is built from the ground up to ensure organizational data is strictly isolated, encrypted, audited, and compliant.
100% of MapMyCare data—including primary databases, point-in-time backups, and secure file storage—is hosted exclusively in the EU West 2 (London, UK) data center. Your data never leaves the UK, ensuring complete compliance with UK GDPR data sovereignty.
Our database enforces strict PostgreSQL Row Level Security. Cross-organizational data leakage is prevented at the database kernel level. Staff can only access profiles assigned to their specific Care Home ID.
Modifications and deletions automatically stamp cryptographic user IDs (`updated_by_uid`) and apply soft-delete protection to risk assessments, preventing permanent accidental data loss and supporting regulatory reviews.
All network communications are encrypted in transit using TLS 1.3 / HTTPS. All database disks and automated backups are encrypted at rest using industry-standard AES-256.
Server responses enforce strict Content Security Policy (CSP), HTTP Strict Transport Security (HSTS 2-year preload), X-Frame-Options DENY, and MIME-sniffing protection to defend against browser-based attacks.
Care Home Managers hold total control over staff access approvals. All accounts enforce a minimum 12-character password policy and server-validated session tokens (`getUser()`).
Every update to a resident's risk assessment triggers an automated change notification requiring staff digital sign-off, providing complete accountability for Ofsted / SCCIF inspections.