Security & trust
The most sensitive data a family will ever hand over.
Medical histories, legal agreements, payment schedules, and the identities of everyone involved in creating a child. Here is how it is held, who can reach it, and what we refuse to do with it.
Encrypted in transit and at rest
TLS on every connection, encryption at rest on the database and on stored documents. Medical records are encrypted wherever they are stored: in the database, in file storage and in every backup.
Isolated per agency
Each agency’s data is kept apart by access rules enforced in the database itself (row-level security), and the server code that runs with wider rights checks the agency on every request. A signed-in user’s query cannot reach another agency’s families.
Access by role, not by trust
A coordinator sees every enquiry, parent and surrogate record, and the full detail of the journeys they manage. A viewer cannot edit. Agency admins and viewers can read every conversation in the agency; coordinators read those on their journeys. Every message sent is kept on the record.
Who can see what
Staff, parents, surrogates and lawyers on one journey, each seeing only their part.
A surrogate and the intended parents share a journey but not a view of it. Each person sees only their share, and your staff choose, document by document, who else may see it.
Agency admins see everything in the agency; a coordinator sees the full detail of the journeys they manage. Visibility is set document by document, and each conversation has fixed members, so sharing one record never opens the whole journey: a scan shared with the parents is not shown to the surrogate unless you share it with her too. A lawyer sees the legal documents of the journeys they are assigned to (or of every journey, if your agency allows it) and the names of the parties, never their contact details. Contact details are never shared between parents and surrogate.
The refusals
What we will not do with your data.
Four things we have decided against. Any change that reduces your protection needs your agreement (section 11.2 of our data processing agreement).
We do not hold anyone’s money
Payments are tracked against milestones and never processed here. Escrow, transfers and card handling stay with the people licensed to do them.
We do not train models on your families
Your data is not used to train anything, ours or anyone else’s.
We work in your name, not ours
Your name, logo and colours on the portals and on every email, with a small “Powered by Carme” line at the foot. Connect your own web address whenever you like. We never contact your families for our own purposes: the only emails they get are the ones your workspace sends in your name.
We do not sell your data or show it to other agencies
We do not sell, share, or show any agency figures drawn from another agency’s families. No aggregate data sold on, no “industry insights” built from other people’s families.
The audit trail
Every change, attributable.
Every change to a journey record (who made it, when, and the record after the change) is logged as it happens. No user, admin included, can edit or delete the log. When a family, a lawyer or a regulator asks how a decision was reached, you hand over a record.
This matters most at exactly the moments it is hardest to reconstruct: a match that was declined, a clearance that expired, a payment that was queried.
Where we are still building
The part a security page usually hides.
We are a young platform. Some of what procurement will ask for is in place and some is not. Here is which is which.
In place today
- Encryption in transit and at rest
- Each agency’s data kept separate by the database itself
- Role-based access, with visibility set document by document
- An audit trail of every change to records, which no user, admin included, can edit or delete. Reading a record and sending a message are not in the audit trail; the messages themselves are kept
- Two-step sign-in (authenticator app, with an emailed code as a guarded fallback) switched on for all staff of a new agency, and the agency admin can change it per role; always required for platform administrators; optional for families
- Passwords of at least 10 characters, checked against common and known-breached passwords; a bot check on the sign-in page
- Nightly encrypted backups of the database and stored files, taken by a scheduled job on Carme’s own encrypted computer, with an encrypted offsite copy in the EU held under a 30-day lock — on top of the database provider’s own daily backups
- One hosting region for your data: Dublin, EU (Vercel dub1, Supabase eu-west-1)
- A published data processing agreement under UK and EU GDPR Article 28, with breach notice to you within 48 hours
- Every sub-processor named in that agreement, with where it processes data. Email delivery, the sign-in bot check, the optional AI assistant, donor portraits and e-signature may process data outside the EU, under the EU–US Data Privacy Framework or standard contractual clauses; the optional ones are yours to switch off
- Translation, summaries and drafting run on a model provider under contract; your data is not used to train it, and every call is written to an audit table you can read
Not yet in place
- A full restore from the offsite backup — not yet rehearsed end to end
- SOC 2 Type II — not yet certified; audit not yet begun
- Third-party penetration test — not yet commissioned
- Customer-managed encryption keys — on our roadmap, not offered today
- HIPAA BAA — not yet offered; the reason is explained below
If your procurement process needs something not listed here, ask. We would rather tell you we do not have it yet than discover the gap together during an onboarding.
Read the data processing agreement and the full sub-processor list →
Found a security problem? Tell us at security@carmesrm.com.
HIPAA
Why we do not claim HIPAA compliance.
HIPAA is not an accreditation. There is no official HIPAA certification for anyone to hold. It is a US law that binds covered entities — health plans, healthcare clearinghouses and healthcare providers that bill electronically — and the business associates that handle protected health information for them under a business associate agreement (BAA).
Most surrogacy agencies are not covered entities, so the records they keep are usually not protected health information under HIPAA, and their software does not need a BAA. If your agency is a covered entity, or works on behalf of one, tell us before you put patient records into Carme.
We do not sign BAAs today. A BAA would only mean something if every service that could touch that data — database hosting, email delivery, the optional AI assistant — were under one too, and today they are not. We will offer a BAA once that whole chain is covered, and not before.
What we do instead is apply the kind of safeguards HIPAA’s Security Rule describes to everyone’s data: encryption in transit and at rest, separation between agencies in the database itself, role-based access with visibility set document by document, an audit trail of changes that no user can edit or delete, two-step sign-in, nightly encrypted backups, a written security policy with a named Security and Privacy Officer, and a risk analysis, first done in October 2026 and reviewed every year.
Some US states protect health data whether or not HIPAA applies, among them Washington (My Health My Data Act), Nevada, Connecticut and California (Confidentiality of Medical Information Act). Under those laws your agency decides what is collected and why, and Carme acts as your processor. Our commitments as processor are in the US state health data addendum to our data processing agreement.
Send us your security questionnaire.
We will fill it in properly, mark honestly what we do not yet have, and tell you where the rest stands. No security theatre.