Skip to content

Security and privacy

Review the evidence before the records.

Household records can reveal locations, access arrangements and personal information. This page distinguishes the product's mechanisms from the checks still required before sensitive onboarding.

Review status

Status dated 8 September 2026: production verification of expanded household isolation, staff offboarding, privileged-action records and household-scoped automated emails remains pending. Changes under development are not presented here as verified production controls.

Sensitive household onboarding should wait for an agreed security review and documented verification. Use fictional information for evaluation. Do not enter medical records, access codes or real household documents into the public demonstration.

Authentication and access

  • Staff sign-in uses email links through Supabase. Email accounts and links still need protection; passwordless sign-in does not eliminate phishing.
  • The application uses role checks and database access policies. The effective permissions for each household and staff role must be tested against the deployed configuration.
  • Some guest and vendor workflows use purpose-specific links. Treat a link as a credential and agree its recipient, expiry and revocation arrangements.
  • A role shown in the demonstration is a product workflow, not proof of database isolation. The review must include denied access and a departing or suspended staff member.

Demonstration and privacy

The public demonstration uses fictional household information. It is available to explore without a client account and is not a place to store a real household's records. Demonstrated tasks, emergency scenarios and staff roles do not provide real-world coverage.

See the privacy notice for website information, inquiries, analytics and processors. Before real data is introduced, agree what may be processed by hosting, email and AI providers, who may receive it, and the retention and deletion terms.

What a review should establish

  • The deployed application version, applied access policies, household boundaries and results of cross-household and staff-permission tests.
  • Administrative access, suspension and link revocation, along with the scope and retention of action logs.
  • Hosting regions, processors and AI data flows, supported contractual terms, and responsibility for incident response.
  • Backup and recovery arrangements demonstrated by a restore exercise, plus a usable household export and a documented deletion process.
  • The support contact and agreed response arrangements. Software support is separate from household or emergency response.

This page is not a certification or an independent penetration-test report. No SOC 2 assurance is claimed. Any evidence that is unavailable should remain an open question in your procurement review.

Contact and review requests

For a security questionnaire, a product-security concern or onboarding review, contact hello@dimoraprivate.com. Send a general description first. Do not email access codes, medical records or exploit data containing household information; agree an appropriate way to exchange supporting material.

You can also request a software discussion or explore the fictional demonstration. A software review does not require purchasing a paid consultation.