CoreRegistration2027
Security & Compliance

Security you can build on.On every package.

Core Registration is built for organizations that hold sensitive information about families, children and money. Here is how we protect it, in plain terms — and every package, the free one included, gets the same protection.
RLS
Tenant isolation
MFA
Staff authentication
Audit
Audit trails
Our compliance roadmap

SOC 2

Compliance in progress

Building trust, with independent assurance.

Our SOC 2 compliance work is in progress. We’re preparing for an independent assessment of our security controls and will share our audit report when it is available.

A SOC 2 report has not yet been issued. Contact us for our current status and security documentation.

Compliance

Designed around the rules you work under.

We built Core with these laws and standards in mind, and we give your legal and IT teams something concrete to review. Compliance is shared: we provide the controls and the agreements, and your own policies matter too. We don't claim certifications we don't hold.

PCI DSS
Card data handled by our payment processor, never stored by Core.
COPPA
Protections for information about children under 13.
e-Sign Act
Legally binding digital signatures on forms, waivers & contracts.
BIPA
Face matching in photo sharing only with consent, with limits on how long it is kept.

Security comes with every package.

Role, row and field-level access, tenant isolation in the database and audit trails come with every account. Not as add-ons. Not as enterprise upgrades.

Security architecture

Defense in depth — at every layer.

Access rules are enforced in the database itself, not only in the screens — so a mistake in one page can't show one organization's data to another.

01

RBAC × RLS × Field-Level Security

Role, row, and field-level access enforced top to bottom — internal staff, external attendees, and family-portal users each see only exactly what they should.

02

Encrypted & Tenant-Isolated

Encryption in transit and at rest, and each organization walled off from every other by row-level security in the database.

03

Audit Trails

Changes to health records, money, e-signatures and staff access are logged with who did what and when, so you can answer an auditor’s question.

04

MFA & Trusted Devices

Two-step sign-in (authenticator app) for staff, with trusted devices. Staff who can see health records or money are asked to turn it on.

05

Help With Your Review

Card data kept with our payment processor, and a team that answers your security questionnaire. Hospital-run or medical programs: talk to us.

Need documentation for your security review?

Talk to our security team directly — we answer custom questionnaires. Hospital-run or medical programs: talk to us before you send us any records.

Ready to put Core Registration to the test?

Schedule a technical deep-dive with our security team and we'll walk through our controls architecture, and answer your questionnaire.