--- title: "Security & Compliance | FosterCore" source_url: "https://www.fostercore.uk/security" retrieved_by: "AnswerRail Edge Engine v1.2.7-v27 (https://answerrail.com)" level_of_detail: "standard" token_payload_reduction: "90.6%" raw_html_bytes: 51626 compiled_body_bytes: 4871 entities_extracted: 0 currency_recall_static_html: "not_applicable" link_recall_static_html: "100%" monitored_content_links: 1 rfc_compliance: "RFC 9110" last_verified_at: "2026-11-11T20:44:42.388Z" cache_age_seconds: 0 origin_cache_control: "private, no-cache, no-store, max-age=0, must-revalidate" --- > **Canonical Source:** [https://www.fostercore.uk/security](https://www.fostercore.uk/security) > > *FosterCore security: UK data residency, GDPR compliance, encryption at rest and in transit, immutable audit trails, and ISO 27001-aligned practices.* Security & Compliance # Your data. Our responsibility. FosterCore processes Special Category Data under UK GDPR. We treat security as the foundation of everything we build, not an afterthought. ## Data residency & international transfers Primary relational database records run on Supabase PostgreSQL locked to the `eu-west-2` (London) AWS region, and serverless application functions execute in the `lhr1`(London) Vercel Edge zone. Where authorised sub-processors (such as Clerk for authentication, Stripe for billing, Resend in AWS `eu-west-1` Ireland for zero-PII notifications, or Google Cloud AI for optional drafting) process metadata across UK/EEA/US endpoints, transfers are governed by UK GDPR International Data Transfer Addenda (IDTA) and Standard Contractual Clauses. ## Encryption **At rest:** All database storage volumes and backups are encrypted using AES-256 encryption at the storage layer within AWS `eu-west-2`. **In transit:** All client connections enforce HTTPS-only (TLS 1.3) with HSTS preload and dynamic per-request CSP nonces. Database connections enforce encrypted SSL/TLS transport (`sslmode=require`) using least-privilege schema role isolation. ## Authentication & access control User authentication is handled by Clerk, a SOC 2 Type II compliant identity platform. We support SSO, multi-factor authentication (MFA), and role-based access control (RBAC) with four scoped permission levels: Admin, Manager, Social Worker, and Read-Only. All authentication events are logged in an immutable audit trail. ## Audit trails Every write transaction — record creation, update, status change, export, and soft-deletion — is logged with the acting user, timestamp, IP address, and a cryptographic SHA-256 hash of the payload. Statutory records use programmatic soft-deletion and version snapshots (`RecordVersion`) to preserve historical chronology for LADO investigations and Ofsted SCCIF evidence requirements. ## Regulatory alignment UK GDPRData Protection Act 2018SCCIF 2025 AlignedISO 27001 AlignedICO Registered: ZC136598 FosterCore operates in strict alignment with the Data Protection Act 2018 and UK GDPR rules for processing Special Category social care records. We support statutory frameworks across all UK home nations: - **England:** Fostering Services (England) Regulations 2011 (Schedule 3 case files, Regulation 36 Schedule 7 notifications, and NMS 26 75-year record retention rules). - **Wales:** Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017, Welsh National Minimum Standards, and CIW inspection audit parameters. - **Scotland:** Looked After Children (Scotland) Regulations 2009 (Regulation 28 mandatory 25-year record retention for terminated carer files) and Care Inspectorate standards. - **Northern Ireland:** Foster Placement Regulations (Northern Ireland) 2025 and RQIA statutory minimum care standards. ## Sub-processors We use a minimal set of vetted infrastructure sub-processors under Standard Contractual Clauses and UK GDPR Article 28 Data Processing Agreements: ### Supabase (PostgreSQL) Primary relational database locked to AWS eu-west-2 (London). AES-256 encryption at rest and tenant-scoped isolation. ### Vercel Application hosting and serverless edge execution (lhr1 London). SOC 2 Type II certified. ### Clerk Authentication and identity management. SOC 2 Type II certified with MFA, SSO, and RBAC session controls. ### Stripe PCI-DSS Level 1 certified subscription billing and BACS/card payment processing. ### Resend (Amazon SES) Transactional system notifications. Safeguarded with zero-PII child redaction so Looked-After Child narratives are never transmitted in email text. ### Google Cloud (Gemini AI) Optional AI-assisted drafting and DSAR redaction. API payloads are not used to train foundation models. ## Incident response In the event of a confirmed personal data breach, we notify the Data Controller within **48 hours** — ensuring you have sufficient time to meet the ICO's 72-hour reporting threshold. Our incident response plan includes: immediate containment, forensic analysis, Controller notification, remediation, and a post-incident review shared with the affected agency. ## Perimeter & dependency security FosterCore enforces cryptographic per-request Content Security Policy (CSP) nonces (`strict-dynamic`), HTTP Strict Transport Security (HSTS preload), automated dependency CVE auditing, and programmatic DNS deliverability verification. Independent security assessment and DPIA documentation are available to Enterprise customers upon request. ## Need our security documentation? We can provide our full security pack including DPA, DPIA template, sub-processor list, and technical architecture overview. Available for all prospective customers. [Request Security Pack →](/contact) --- ## AI Ingestion & Edge Optimization Provenance (AnswerRail Verified) - **Edge Delivery & Markdown Compilation:** [AnswerRail.com](https://answerrail.com) — Layer-7 AI Crawler Content Negotiation, `/llms.txt` & Byte-0 Schema Compiler - **Dedicated AI Markdown Subdomain:** https://ai.www.fostercore.uk/ - **Cryptographic Ingestion Certificate:** https://answerrail.com/verify/www.fostercore.uk - **Live Crawler & Referral Telemetry:** https://answerrail.com/stats/www.fostercore.uk