Plain answers to the questions directors, sponsors and county IT departments ask us. Updated October 2026.
Every connection uses HTTPS (TLS). The database and every uploaded file are encrypted at rest with AES-256.
Access rules are enforced inside the database itself, not just in the app. One program can never see another's records, even through the API.
Stipend runs, budget, program files and settings are limited to directors at the database level. Coordinators see the day-to-day screens only. Nobody can change their own role.
Sign-ins, approvals, stipend runs, document views, downloads and settings changes are recorded by the database and cannot be edited or deleted from the app.
Any user can turn on a 6-digit authenticator-app code for their login. Shared office computers are signed out automatically after a period of inactivity (your director sets how long).
The database is backed up daily. You can also download a complete copy of your program's data at any time from Settings.
The best protection is not holding data you don't need. CompanionTracker keeps client records to a first name and last initial. Volunteer records never include Social Security numbers, and income eligibility is recorded as a band ("under the limit"), not an amount. Bank and routing numbers are never stored: check printing uses your pre-printed check stock. Photos of licenses, insurance cards and physicals live in private storage and are only opened through short-lived links, never a public address.
In the United States (AWS us-east-1, Northern Virginia) on Supabase, a managed Postgres platform. The website and app are served by Vercel. Neither company's staff has routine access to your records.
Your own directors and coordinators, according to their roles. CompanionTracker's owner can open a program only to provide support, and those actions are logged like everyone else's.
Passwords are hashed, never stored. Logins are created by invitation from your director; there is no public sign-up. Password resets go through a time-limited email link.
Yes. Any user can turn on an authenticator-app code under Settings → Logins.
Your data is yours. Download a full copy from Settings at any time. When a program closes its account, its records and files are deleted from live systems, and from backups as those backups age out.
Senior Companion programs are not HIPAA covered entities and CompanionTracker is not designed to hold medical records. Keep the annual physical as a yes/no with a date, which is how the app stores it, and leave clinical details in the station's own files.
We would tell your program director what happened, what was affected and what we did about it, and we follow state breach-notification law.
Send it to support@companiontracker.com and we will review it with you.