Security
Tiny Solutions checks the agency and the role before it reads or changes a child record. Files open only after sign-in. The audit history is only added to, never rewritten. Account email carries no health information.
The agency is checked before the record. On every request, the server checks who is signed in, which agency they are working in, and their role. Hiding a button is never the only protection.
The server confirms the current agency before it reads or changes a child record or a document.
The server checks each person's role (Owner, Admin, Service coordinator, or Provider) against each action and each record.
Each entry records who acted, when, and which record changed. Earlier entries are never rewritten.
Files on a child record open only for signed-in people in that agency. There are no public links to documents.
Security that people can understand and use. A secure account still needs a clear way back in.
Log in with a passkey, a password, an email code, or a sign-in provider your agency sets up.
A second step at sign-in, and another check before higher-risk actions.
Account links work once and then expire.
People see the devices they are signed in on, and can sign out of one device or all others.
Admins can cancel or resend an invitation that has not been accepted.
When you remove a person from the agency, the history of who did what stays.
Each outside service gets only what its job needs. A service that does not need child or family information does not receive it.
Email carries sign-in and account details only. It never contains a child's name, a fact about the case, or a Medicaid ID.
Stripe receives only what it needs to bill the agency. It never receives child records or EI Hub claims.
Google receives only the street address a person types into the address search.
Shared responsibility
Software alone does not meet HIPAA and FERPA duties. They also depend on agreements, devices, staff training, access reviews, and the choices an agency makes after setup.
Product design, permission checks on the server, audit history, account security, what outside services receive, and recovery.
Who gets access, which devices are approved, how staff handle records outside the product, and when access is reviewed.
Our answer says what the product does, what our hosting providers do, and what still depends on your agency's policy.
Leave child and family information out of the questionnaire.