Security & Trust

Last updated: July 21, 2026

QSP Central handles the records that run a care agency — including protected health information (PHI) — so security is designed in, not bolted on. This page is written for the person your director forwards it to: it says what we actually do, in plain language. Questions or something to verify? Email qspcentral@gmail.com and we'll walk through it with you.

Encryption, everywhere

In transit: every connection to QSP Central uses HTTPS/TLS — browser to app, and app to database (with certificate verification, not just encryption).
At rest: the database and all uploaded documents are stored encrypted on AWS, using customer-managed encryption keys for the database volume.

Your agency's data is isolated — enforced by the database itself

Every record carries your agency's identity, and PostgreSQL row-level security enforces the boundary at the database layer. The application connects as a least-privilege role that the isolation rules apply to, and the server verifies this posture at every startup. One agency's staff can never query another agency's data — even a bug in application code can't cross that line.

Access control

Sign-in is handled by Clerk, a managed identity provider operating under a HIPAA Business Associate Agreement.
Roles (admin, coordinator, supervisor, viewer) gate every endpoint — payroll dollars, exports, and settings are restricted to the roles that need them.
Idle sessions sign out automatically after 30 minutes, on every open tab.

Everything is on the record

QSP Central keeps an append-only audit log: every create, change, archive, sign-in, and bulk view of client data is recorded with who, when, and what changed — including who opened which document. At the infrastructure level, AWS CloudTrail writes to write-once storage with a 7-year retention lock, and Amazon GuardDuty watches for anomalous access continuously.

Hosting & backups

Hosted on AWS (US region) under AWS's HIPAA Business Associate Agreement; the database is on a private network with no public access.
Automated encrypted backups run daily with point-in-time recovery; deploys are gated on a full automated test suite before they can reach production.
Nothing is ever hard-deleted by day-to-day use — records are archived and recoverable.

HIPAA posture

QSP Central is designed to support HIPAA compliance: we sign a Business Associate Agreement with every agency before PHI is processed, and the safeguards above map to the HIPAA Security Rule's technical requirements. We're an early-access product and we say so plainly — if your compliance reviewer wants specifics beyond this page, we'll answer directly.

Reporting a concern

If you believe you've found a security issue, email qspcentral@gmail.com with the details. You'll hear back quickly — usually the same day.