Security & privacy
Security, privacy and data protection, built around children in care.
CaringLife is designed to protect information that is deeply personal to children and young people. Security, privacy and appropriate access controls are built into the way photos, videos, documents, journals and life story information are stored, accessed and managed.
Grounded in
- ISO/IEC 27001
- ISO 9001
- Cyber Essentials
- AWS
ISO 27001
certified information security management, covering people, process and technology — not just the platform
5 COUNTRIES
with dedicated in-country AWS data hosting: UK, Australia, New Zealand, Canada and the US
MFA
multi-factor authentication protecting every CaringLife account
AWS
secure cloud infrastructure, with encryption in transit and at rest
Protecting children’s information
More than secure storage
CaringLife is used to preserve children’s memories and life story information over many years — memories that matter, entrusted to us by children, carers and the people who look after them. Honouring that trust takes more than secure storage.
It’s why we combine secure cloud infrastructure, controlled access, authentication, moderation, auditing, data protection processes and ongoing information security management — so every memory stays safe, for as long as it’s needed.
This includes
- ISO 27001 certified information security management
- Cyber Essentials certification
- In-country data hosting
- Multi-factor authentication
- Controlled access to children's accounts
- Regular vulnerability management and security testing
- Incident response and breach management procedures
- ISO 9001 certified quality management
- Secure AWS cloud infrastructure
- Encryption in transit and at rest
- Role-based access controls
- Audit logging
- Backups and recovery processes
Data hosting
Where is CaringLife data stored?
CaringLife uses AWS cloud infrastructure to provide secure, resilient hosting. Children’s information is stored within the country or approved data region applicable to the service in which CaringLife is being used.
| Country | Data Hosting |
|---|---|
| United Kingdom | AWS infrastructure in London |
| Australia | AWS infrastructure in Sydney |
| New Zealand | AWS infrastructure in Auckland |
| Canada | AWS infrastructure in Montreal |
| United States | AWS infrastructure in North Virginia |
This approach helps organisations meet their data residency and privacy obligations while ensuring children’s life story information remains protected within the appropriate jurisdiction.
BUILT ON CERTIFIED STANDARDS
ISO/IEC 27001
ISO 9001
Cyber Essentials
Full certificates and audit summaries available for procurement and due diligence.
Certified information security
Independently certified
Three independent certifications sit behind CaringLife’s approach to security, quality and cyber hygiene.
Information security management
ISO/IEC 27001
The internationally recognised standard for information security management
CaringLife is certified to ISO/IEC 27001, the internationally recognised standard for information security management systems. ISO 27001 provides a structured framework for identifying, managing and reducing information security risks across an organisation. For CaringLife, this extends beyond the technology itself and includes the people, processes, policies and controls involved in protecting information.
Quality and cyber hygiene
ISO 9001
Quality management
CaringLife is also certified to ISO 9001, the international standard for quality management systems. This supports a structured approach to service delivery, continuous improvement, documented processes and organisational accountability.
Cyber Essentials
Protection against common threats
CaringLife holds Cyber Essentials certification, supporting our approach to protecting systems against common cyber security threats.
Infrastructure
Secure cloud infrastructure
CaringLife is hosted using Amazon Web Services (AWS). AWS provides the underlying cloud infrastructure used to securely host and process CaringLife data.
AWS maintains an extensive range of independent security and compliance certifications and assurance programs across its global infrastructure. These AWS infrastructure credentials are separate from certifications held directly by CaringLife.
Encryption
Protected in transit and at rest
CaringLife protects information both while it is being transmitted and while it is stored.
In transit
Encryption in transit
Information transmitted between users and CaringLife is protected using secure encrypted connections.
At rest
Encryption at rest
Stored information is encrypted within the AWS environment to provide an additional layer of protection against unauthorised access.
Access & privacy
Access is controlled
Access to children’s information is restricted to authorised users and managed according to their role and relationship with the child. CaringLife uses role-based access controls so that users only receive the level of access appropriate to their responsibilities.
Who can be authorised, depending on the service
Children & young people
See and add to their their story, with age-appropriate access.
Social workers & case managers
Oversee it, upload memories and keep it consistent through every placement.
Carers
Foster, kinship or residential carers adding moments as life happens.
Authorised managers
Retain oversight across the organisational accounts.
Approved family & significant people
Contribute where connections are appropriate and approved.
Connected doesn’t mean unrestricted
Being connected to a child’s CaringLife account does not automatically mean every user can see everything within it. Permissions and sharing controls help protect the child’s privacy while allowing appropriate people to contribute to their life story.
Day-to-day security management
How CaringLife manages security
Multi-factor authentication
Identity & access management
Additional protection for account access
CaringLife uses multi-factor authentication to provide additional protection for account access. Authentication controls reduce the risk of an account being accessed using a compromised password alone and form part of CaringLife’s broader identity and access management approach.
Social worker and case manager oversight
Moderation
Designed around the realities of children's social care
Social workers and authorised case managers can review and moderate content contributed to a child’s account. This helps organisations maintain appropriate oversight while enabling children, carers and other authorised people to contribute important memories and life story information. Moderation also provides continuity when a child changes placement or the professionals around them change.
Audit and accountability
Audit logging
Knowing what has happened within the system
Security is also about knowing what has happened within a system. CaringLife maintains audit information to support oversight, accountability and investigation where required. Access and administrative activities can therefore be reviewed as part of security, support and incident-management processes.
Backups and resilience
Business continuity
Built to protect memories for years, not months
Children may rely on CaringLife to preserve memories and documents for many years. Our approach to resilience includes regular backups and recovery processes designed to protect information against accidental loss, system failure and other disruptive events. CaringLife maintains business continuity, backup and recovery processes as part of its broader information security management framework.
Security testing and vulnerability management
Vulnerability management
Finding and fixing issues before they matter
CaringLife maintains processes for identifying and addressing security vulnerabilities. These include vulnerability scanning, security testing, patch management and independent penetration testing. Security findings are assessed and managed according to risk, with higher-risk vulnerabilities prioritised for remediation. Our security approach continues to evolve as technology, risks and recognised security practices change.
Privacy & compliance
Privacy and data protection
CaringLife operates across multiple jurisdictions and supports organisations with different statutory and regulatory obligations. Our privacy and data protection approach is designed to support compliance with applicable requirements in the countries where CaringLife operates.
United Kingdom
UK GDPR & DPA 2018
UK GDPR and the Data Protection Act 2018.
European Union
GDPR
General Data Protection Regulation (GDPR).
Australia
Privacy Act 1988
The Privacy Act 1988 and Australian Privacy Principles.
New Zealand
Privacy Act 2020
Privacy Act 2020.
Canada
Federal & provincial privacy law
Applicable Canadian federal and provincial privacy requirements.
United States
COPPA & state privacy law
The Children’s Online Privacy Protection Act (COPPA) and applicable state privacy laws, such as the California Consumer Privacy Act (CCPA/CPRA).
Specific contractual and regulatory requirements can be addressed with an Authority or Agency during implementation and procurement.
Data protection roles
Who controls the data?
For services provided to Government Departments, Local Authorities and care organisations, responsibilities are clearly split.
- Data Controller
- Generally the commissioning organisation — Government Department, Local Authority or care organisation
- Determines how and why children's personal information is processed
- Sets contractual and regulatory requirements with CaringLife
- Data Processor
- CaringLife acts as the Data Processor
- Processes information to provide the CaringLife service on behalf of the organisation
- Relationship supported through contractual data protection and information security requirements
Continuity
Life story work that doesn't restart
A placement change — or growing up and leaving care — shouldn’t mean a child’s life story starts again.
Placement change
What happens when a child changes placement?
A placement change does not mean starting a child’s life story again. The child’s CaringLife account continues with them. New authorised carers can be connected to the existing account without being automatically given access to everything previous carers have contributed — allowing the child’s life story to continue while maintaining appropriate privacy and access controls.
Leaving care
What happens when a young person leaves care?
CaringLife is designed so that a young person’s memories do not disappear when their involvement with the care system ends. Young people retain access to their CaringLife information after leaving care or reaching adulthood — the child’s life story should ultimately remain available to the person whose story it is.
Why we built it this way
Built with children in care at heart
Every child in care has a story worth keeping safe. That’s why privacy and safeguarding sit at the centre of every decision: how accounts are set up, who can see what, how content is gently moderated, and how memories are kept safe for as long as a young person needs them.
FAQs
Security questions from organisations
Is CaringLife ISO 27001 certified?
Yes. CaringLife is certified to ISO/IEC 27001 for information security management.
Is CaringLife ISO 9001 certified?
Yes. CaringLife is certified to ISO 9001 for quality management.
Does CaringLife hold Cyber Essentials certification?
Yes. CaringLife holds Cyber Essentials certification.
Where is children's data hosted?
CaringLife uses AWS cloud infrastructure, with children’s data stored within the applicable in-country hosting region for the service.
Is CaringLife GDPR compliant?
CaringLife’s privacy and information security arrangements are designed to support organisations in meeting applicable UK GDPR and GDPR requirements when using the service.
Is data encrypted?
Yes. CaringLife uses encryption to protect information in transit and at rest.
Does CaringLife support multi-factor authentication?
Yes. Multi-factor authentication provides additional protection for account access.
Can access be restricted?
Yes. CaringLife uses role-based permissions and controlled connections to restrict access to authorised users.
Can social workers moderate content?
Yes. Authorised social workers and case managers can review and moderate content contributed to children’s accounts.
What happens to data when a child leaves care?
Young people retain ongoing access to their CaringLife information after leaving care or reaching adulthood.
Can CaringLife support a DPIA or security assessment?
Yes. CaringLife can provide relevant security, privacy and service information to support organisational due diligence, procurement and Data Protection Impact Assessment processes.
For procurement teams
Security information for procurement teams
We understand that Government Departments, Local Authorities and care organisations may require detailed information before introducing a service that processes children’s information.
CaringLife can support procurement and information governance assessments with documentation relating to areas including:
- Information security
- Data hosting and residency
- Business continuity
- Incident management
- Penetration testing
- Data processing arrangements
- Data protection
- Access controls
- Backups and recovery
- Vulnerability management
- Supplier management
- Implementation and support
Need security or procurement information?
Our team can provide the information required to support your organisation’s security, privacy and procurement assessment.
About CaringLife
Secure Digital Life Story Work
CaringLife provides secure Digital Life Story Work for children and young people in foster, kinship, residential and other forms of out-of-home care. It enables children, carers and professionals to preserve photos, videos, documents, journals and important memories throughout a child’s care journey and beyond.