Compliance & security
Ready for your next audit, every day of the year
CareHub keeps the records an NDIS audit asks for as a side effect of normal work, and protects participant information as the health information it is.
Incidents
No reportable incident slips past its deadline
- Anyone can report an incident: from the visit screen, the worker app or the office.
- Reportable incidents start the NDIS Commission clock: 24 hours, or 5 business days for an unauthorised restrictive practice that caused no harm.
- The deadline shows on the dashboard and turns red when it's passed.
- A reportable incident can't be closed until the Commission notification and the outcome are recorded.
- Photos and documents attach to the incident.
Worker checks
- NDIS Worker Screening, police check, Working With Children Check, first aid, CPR, licence, insurance and training records.
- A mandatory check that expires blocks rostering that worker until it's renewed.
- Anything expiring in the next 30 days appears on the dashboard.
Family portal
Families informed, without phone tag
Families and participants can have their own read-only login. They see:
- upcoming visits and which worker is coming (first name only)
- progress notes the team has chosen to share
- invoices
They can't change anything.
Audit trail
Who did what, and when
Every change, sign-in, approval, export and document download is recorded with the person and the time. Timesheet corrections are logged too, so an adjusted visit is never a mystery.
Security
How participant data is protected
Built by an infrastructure and data engineering team, with privacy designed in rather than bolted on.
- Hosting: database and documents in Cloudflare's Oceania region.
- Separation: each provider's data is isolated; another provider's records are simply not found.
- Sign-in: passwords stored as salted PBKDF2 hashes; repeated failures lock the account for 15 minutes; sessions end on password change.
- Access by role: owner, admin, coordinator, support worker and family each see only what their job needs.
- Documents: stored privately and only downloadable after a permission check.
- Web security: encrypted connections, strict content security policy, protection against cross-site requests.
- No trackers: no advertising, analytics or AI services receive participant data.
Questions from your compliance lead?
We're happy to go through security, data handling and hosting in detail.