Legal

Information security and privacy policy

Version 1.0, effective 26 October 2026. This policy is published in English; the English text governs. Esta política se publica en inglés y el texto en inglés es el que rige.

This is the policy Carme runs itself by. It describes the platform and the way we work as they are today, including what is not yet in place. It sits alongside our data processing agreement, which is the contract, and our security page, which is the plain-language summary.

1. Purpose and scope

1.1 This policy sets out how Carme protects the confidentiality, integrity and availability of the information it holds, and how it handles personal data, in particular the health and other special category data that surrogacy agencies record in the platform.

1.2 It covers the Carme platform at carmesrm.com and its portals, the systems and services used to build, host, back up and support it, and everyone who works on Carme (Platform Personnel), including founders and contractors.

1.3 For the data of an agency’s intended parents, surrogates, donors and families, the agency is the controller and Carme is its processor. This policy describes Carme’s side of that arrangement; each agency remains responsible for its own policies, its users and what it chooses to record and share.

2. Roles and responsibilities

2.1 The Security Officer owns this policy and the risk analysis, decides who has access to production systems, leads the response to any security incident, and approves exceptions to this policy.

2.2 The Privacy Officer is responsible for the data processing agreement and the sub-processor list, handles requests and questions from agencies and data subjects, assesses whether an incident is a personal data breach, and makes sure agencies are notified on time.

2.3 Every person who works on Carme must follow this policy and report any suspected security problem to the Security Officer straight away.

3. Risk management

3.1 Carme carries out a documented security risk analysis at least once a year, and again whenever there is a material change: a new sub-processor, a new kind of data, a change of hosting, or a significant incident.

3.2 The analysis identifies the threats to the data, rates each by likelihood and impact, records the controls in place and the risk that remains, and sets the actions to reduce it. The Security Officer approves it and tracks the actions to completion.

3.3 A summary of the current analysis is published in our terms.

4. Access control

4.1 Least privilege. Access is granted by role and only to what each person needs. In the platform, agency staff have the roles administrator, coordinator, viewer or lawyer; an intended parent sees only their own journey; a surrogate sees only her own records. Visibility is set document by document, and each conversation has fixed members.

4.2 Agencies control their users. Each agency decides who it invites and in which role, and can disable a user at once, which ends all of that user’s sessions.

4.3 Carme’s own access. Access to production systems (hosting, database, backups and secrets) is limited to named Platform Personnel approved by the Security Officer. Platform Personnel do not routinely view agency data; they may enter an agency’s account only to give support the agency has asked for, to investigate an incident or fault, or where the law requires. When Platform Personnel sign in to an agency’s account or preview its portals from inside Carme, that is recorded in the agency’s audit log. Direct access to the database, which is limited to named Platform Personnel, is not recorded in the agency’s log.

4.4 Review. Access to production systems is reviewed at least every six months and removed the same day someone no longer needs it.

5. Authentication

5.1 Passwords must be at least 10 characters, are checked against common and known-breached passwords, and may not be the user’s own name or email address.

5.2 Two-step sign-in (an authenticator app, with an emailed code as a guarded fallback) is switched on for all staff of a new agency, and the agency’s administrator can change that for each role. It is always required for platform administrators. It is available to families and surrogates, and an agency can make it mandatory for them too. Resetting someone’s two-step sign-in ends all their sessions.

5.3 The sign-in page is protected by a bot check. Accounts are created only by invitation or through Carme’s own agency sign-up.

5.4 Platform Personnel must use two-step sign-in on every administrative account that can reach production systems or agency data, including the hosting, database, email, backup, domain and code-hosting accounts.

6. Encryption

6.1 All connections to the platform use TLS. The database and file storage are encrypted at rest by the hosting provider.

6.2 Carme’s own backups are encrypted before they leave the system that made them; the offsite storage provider holds no key.

6.3 Secrets (keys, tokens, passwords for services) are kept in the hosting provider’s encrypted configuration or an encrypted password manager, never in source code, and are rotated after any suspected exposure or when someone with access leaves.

7. Separation between agencies

7.1 Every table that holds agency data is protected by access rules enforced in the database itself (row-level security), not only in the interface, so one agency’s users cannot read another’s data even through the API. Uploaded files are stored per agency and per journey and checked against the same rules.

7.2 Automated tests check these rules, and any change to them is tested before release. An internal review on 24 October 2026 attempted cross-agency and cross-person access; the gaps it found were fixed the same week and are now covered by automated tests. No third-party test has been done yet.

8. Logging and audit

8.1 The platform keeps an audit trail of every change to records: who made it, when, and the record after the change. No user of the platform, agency administrators included, can edit or delete it. Reading a record and sending a message are not in the audit trail; messages themselves are kept. Sign-in to an agency’s account by Platform Personnel from inside Carme is recorded there (see 4.3). An agency’s administrators can read the trail for their agency.

8.2 Automated monitoring every 15 minutes covers scheduled jobs, application errors, email delivery and backups, and alerts Platform Personnel when something fails. Each call to the optional AI assistant is recorded in an audit table the agency can read.

9. Backups and restore

9.1 The database provider takes daily backups. In addition, a scheduled job on Carme’s own encrypted computer takes a nightly, verified and encrypted backup of the database and stored files, and keeps an encrypted offsite copy in the EU for 30 days under an immutability lock, so it cannot be altered or deleted during that time.

9.2 Deployments can be rolled back to the previous version at once.

9.3 Carme will rehearse a full restore from the offsite backup at least once a year and record the result. The first full rehearsal has not yet been completed; it is scheduled, and until it is done the time a full recovery would take is unproven. We treat this as an open risk in the risk analysis.

10. Vendors and sub-processors

10.1 Every service that processes agency data is named, with what it receives and where, in Annex 3 of the data processing agreement. Optional services receive data only if the agency switches the related feature on.

10.2 Before a new sub-processor is engaged, the Privacy Officer checks its security commitments and transfer mechanism, a written contract with data protection terms is put in place, and agencies get at least 30 days’ notice, as the agreement requires.

10.3 Each sub-processor is reviewed at the annual risk analysis.

11. Incident response and breach notification

11.1 Carme keeps a written incident-response procedure covering detection, containment, rollback, key rotation, investigation and notification. Every incident is recorded, with what happened, what was affected and what was done.

11.2 If a personal data breach affects an agency’s data, Carme notifies that agency’s administrators without undue delay and in any event within 48 hours of becoming aware of it, and keeps the agency informed as more becomes known, as set out in section 7 of the data processing agreement. The agency decides whether to notify its regulator and the people affected; Carme helps it to do so.

11.3 Anyone can report a security problem to security@carmesrm.com. We acknowledge reports and do not take action against people who report in good faith.

12. Secure development and change management

12.1 Every change is tested on a separate staging environment, with its own database and no real agency data, before it reaches production.

12.2 Automated checks (type checking and unit tests, including tests of the access rules) must pass before a change is released, and each change is reviewed before release, by automated checks and a second review pass.

12.3 Changes to the database are made through versioned migrations. Production releases are recorded, and any release can be rolled back.

12.4 Real agency data is never copied to development or staging environments.

12.5 No independent penetration test has yet been commissioned. When one is, its findings will be tracked through the risk analysis.

13. Personnel and devices

13.1 Platform Personnel are bound by a duty of confidentiality, read this policy when they start and when it changes, and lose access on the day they leave.

13.2 Any device used to work on Carme must have full-disk encryption, an automatic screen lock, a supported operating system with security updates applied, and must be protected by a password or biometric lock.

13.3 Agency data must not be downloaded to personal devices except to give support an agency has asked for, and must be deleted from the device once that is done. A lost or stolen device must be reported to the Security Officer at once, so that sessions and keys can be revoked.

14. Data retention and deletion

14.1 While an agency uses Carme, it decides how long its records are kept and can export or delete them with the platform’s tools.

14.2 When an agency leaves, its account stays available read-only for 30 days so it can export its data; Carme then deletes the data from the live platform when the agency asks in writing and confirms when that is done. Copies in encrypted backups expire on their normal cycle, no more than 35 days later. The detail is in section 9 of the data processing agreement.

15. Privacy and health data

15.1 Carme processes agency data only on the agency’s instructions. It does not sell it, does not use it to train any model, does not use it for advertising, does not sell, share or show any agency figures drawn from another agency’s data, and never contacts an agency’s clients for its own purposes.

15.2 Data is hosted in the European Union (Dublin, Ireland). Where a sub-processor processes data outside the UK and the EEA, the transfer is covered by the EU–US Data Privacy Framework or Standard Contractual Clauses.

15.3 Some US states regulate health data outside HIPAA, among them Washington, Nevada, Connecticut and California. Carme’s commitments as processor under those laws are in the US state health data addendum to the data processing agreement.

16. HIPAA

16.1 Carme does not claim to be HIPAA compliant and does not sign business associate agreements (BAAs) today. HIPAA is a law that binds covered entities (health plans, clearinghouses and healthcare providers that bill electronically) and their business associates; it is not an accreditation, and there is no official HIPAA certification. Most surrogacy agencies are not covered entities.

16.2 Carme will offer a BAA only once every sub-processor that could receive protected health information is itself under a BAA. An agency that is a covered entity, or acts for one, must tell us before putting patient records into Carme.

17. Review and exceptions

17.1 This policy is reviewed at least once a year, and whenever the risk analysis or a significant change calls for it. Each version is dated at the top of this page.

17.2 Any exception to this policy must be approved by the Security Officer, recorded with its reason and an end date, and reviewed at the next risk analysis.

Questions about this policy: security@carmesrm.com for security, privacy@carmesrm.com for personal data.