Security and privacy overview
High-level authentication, authorization, tenant separation, auditability and data-handling behaviour, stated only to the extent the implementation and the Claims & Evidence Register support it.
- Document version
- 1.0
- Last updated
- 2026-09-08
- Document owner
- OWNER INPUT REQUIRED — DOCUMENT GOVERNANCE
- Applies to
- OCRS 2.4.0 (multi-tenant hosted edition)
- Status
- Approved
- Audience
- Security reviewers, Procurement teams, Technical evaluators
- Evidence source
- docs/claims-evidence-register.md · src/lib/permission-matrix.ts · Implemented authentication and audit surfaces
What this document is
This is a bounded public summary. It states implemented behaviour and nothing more: no control is described as certified, audited, penetration-tested or independently verified unless evidence for that statement exists in the Claims & Evidence Register. Deeper security material is controlled and released under a qualified security review.
Implemented controls
| Area | Published statement |
|---|---|
| Authentication | Accounts are created by approval rather than anonymous sign-up. Passwords are set by the account holder from an emailed invitation. |
| Multi-factor authentication | Administrative roles must complete multi-factor enrolment before administrative surfaces are usable. |
| Authorization | Roles live in a dedicated role table, never on a profile record. Reads and writes are constrained to the signed-in user's organization and facility assignments in the database layer, not in the interface. |
| Tenant separation | Every record belongs to one organization, and cross-organization access is refused server-side. |
| Auditability | Sign-ins, submissions, administrative changes, role assignments and extract generation are written to an append-only audit record with no application means to edit or delete it. |
| Data handling | The reporting extract carries no protected health information by construction: the only occupant attribute is an age or the 90+ band. |
| Transport and storage encryption | Traffic is served over HTTPS and the managed database platform encrypts data at rest. |
| Backup and recovery | The managed database platform provides backups. OCRS publishes no recovery-time or recovery-point objective, because none has been approved. |
Statements OCRS does not make
- No compliance certification or attestation (including SOC 2, HITRUST or FedRAMP) is claimed.
- No uptime figure, availability percentage or guaranteed response is published.
- No penetration test, independent security assessment or third-party audit result is claimed.
- No 24/7 monitoring or real-time monitoring claim is made, and no public service-status page or incident history is published.
OWNER INPUT REQUIRED — RUNTIME TENANT ISOLATION VERIFICATION
Tenant separation is implemented and covered by the project's automated permission and isolation suites, but controlled runtime verification in a preproduction environment has not yet been completed and signed off. Until it is, this documentation does not state that tenant isolation has been independently verified.