Security that goes down to the database
Most products enforce privacy rules in application code. CareRing makes consent, retention, and deletion structural constraints the database itself must obey — not optional settings.
What happens to a single phone call
The call connects
When CareRing calls your parent, Twilio carries the call and OpenAI processes real-time audio and transcripts during the conversation; service data that must be persisted enters private Supabase structures. Vendor deletion and disaster-recovery drills are not complete, so we do not promise that data exists in only one system.
Consent decides
Before anything reaches you, the database checks your parent’s current permissions field by field. No consent, no data: not hidden by the interface — absent from the response.
You receive the daily note
The family page shows only a short daily note and cannot read recordings, transcripts, or assistant memory. The database rejects a raw-recording retention deadline beyond 30 days, but that does not prove timely deletion from vendors, file storage, or disaster-recovery copies; transcripts currently have no promised automatic-deletion period.
How this actually holds
This list describes only the database-side constraints already implemented. Production wiring, end-to-end deletion, and real drills that remain incomplete are called out explicitly.
A private boundary at the schema level
Raw calls, memories, and audit records live in private database structures the web application cannot query. The browser-facing interface only ever sees the minimal family-side data.
Consent is verifiable evidence, not a checkbox
Every consent is an append-only event containing a cryptographic fingerprint of the exact text your parent saw. Revocation creates a new event; history is never rewritten. Without written consent, the system cannot even create an outbound call.
Sharing filtered field by field
Family members read through a secure projection that checks every field against your parent’s current sharing choices. Change a choice, and the very next read reflects it.
“Don’t record this” is enforced at write time
When your parent asks for something not to be kept, the database write gate refuses to store it. The system keeps only a fingerprint proving the refusal happened — never the content.
The schema enforces the 30-day recording cap
Raw call recordings carry a retention limit of at most 30 days, and the database rejects any write that tries to keep them longer. Transcripts live in the private system and are covered by deletion requests, but no fixed automatic-deletion period is currently promised.
The database has deletion inventory and state gates
The database has part of the deletion inventory, state constraints, and audit structure. The real log adapter, independent tombstone service, file-storage and Twilio deletion, and post-PITR replay drills are not complete. We do not promise end-to-end erasure or verified results.
Least-privilege runtime
Every backend process uses its own minimal database role. The role serving this website holds no keys to the phone system, and vice versa.
Auditable without keeping identities forever
Actions are attributed to randomly generated audit principals, so accountability survives account deletion without keeping anyone’s identity on file.
Secrets never reach code or the browser
Repository scanning and runtime boundaries refuse to let vendor keys into code, public config, or the browser. Local rehearsals read only from the OS keychain; CareRing won’t launch to real families before the production secret store and rotation are wired.
Monitoring that can’t leak privacy
Health checks return only booleans and counts — never message content or personal data. An engineer debugging at 3 a.m. sees numbers, not what your mother said.
If something is truly wrong
The independent risk guard is still being validated against synthetic voice scenarios, and the latest test set has not fully passed. It therefore cannot guarantee detection in every real conversation or completion of a safe response. The current version does not automatically send notifications to contacts. CareRing is not an emergency service; if you believe someone is in immediate danger, call 911.
External vulnerability reporting is not open yet
CareRing does not currently have a configured, monitored external security-reporting channel and does not promise a response time. Do not send vulnerability details or personal data to placeholder addresses; the real channel will be published here when available.
Want to know more about how CareRing handles data? Read the Privacy Policy