Security

Scope every protected record to the signed-in agency and role.

Tiny checks agency and role before reading or changing child records, keeps files behind authenticated access, appends audit events, and excludes protected health information from account email.

Start a security review Read the privacy notice

Current posture

Agency-scoped access · append-only audit history · no PHI in email

These controls exist in the product today. Request current vendor agreements before entering production health information.

Every protected record operation is scoped to the active agency
Roles reduce access to the work a person is allowed to perform
Audit events are appended rather than rewritten
Child and family information never belongs in account email

Data boundaries

The agency boundary is enforced before the record is read.

Every request to read or change a protected record resolves the signed-in person, active agency, and role on the server. A route name or hidden button is never treated as the security boundary.

Organization isolation

Protected data functions receive the active Organization scope before they touch child records, documents, or related operations.

Least-privilege roles

Admin, Member, Billing manager, and Provider access is checked against the action and record scope.

Append-only evidence

Audit events preserve who acted, when it happened, and which agency record changed without rewriting prior entries.

Accounts and sessions

People get controls they can understand and use.

A secure account still needs a clear recovery path. Tiny Solutions combines sign-in methods, session visibility, role management, and step-up checks around sensitive actions.

Sign-in protection

The account system supports passkeys, password and email flows, configured identity providers, and two-step verification.

Step-up checks for higher-risk actions
Single-use account links
Organization policy without exposing child data in the sign-in flow

Session and staff control

People can review signed-in devices. Admins can manage invitations, roles, and removal without deleting the operating history.

Sign out an individual device or other devices
Revoke or resend a pending invitation
Preserve attribution when a staff account is removed

Protected information

Each outside service gets the minimum data for its job.

Infrastructure boundaries matter because not every service in a software stack should receive child or family information.

Account email

Email messages carry sign-in and account information only. They never include a child name, case fact, clinical detail, or Medicaid ID.

Files

Child-record files stay behind authenticated, agency-scoped access instead of public document links.

Subscription billing

Stripe receives the information needed to manage the agency subscription. It does not receive child records or EI Hub claim details.

Shared responsibility

Software controls do not replace agency policy.

HIPAA and FERPA obligations also depend on agreements, device practices, staff training, access reviews, and the agency choices made after setup.

Tiny Solutions controls

Product architecture, server-side permission checks, audit history, account security, vendor boundaries, and recovery behavior.

Organization-scoped data access
Role and caseload permission checks
Append-only audit history
No-PHI account email
Protected file access

Organization controls

Who receives access, which devices are approved, how staff handle records outside the product, and when permissions are reviewed.

Role assignment and periodic access review
Managed devices and local screen privacy
Staff training and incident procedures
Data entered into exports and outside systems

Request trust materials

Ask for the current evidence

Security materials change as the product moves through development. Request the current agreements and control evidence before entering production health information.

Security review

Bring the real questionnaire.

Send the controls your agency must verify. The answer should name what exists, what is inherited from infrastructure, and what still depends on agency policy.

Do not include child or family information in the questionnaire or email.

Start a security review Read the privacy notice