Enterprise-grade security built for California care facilities
Built with the security features required to protect resident health information
Target: SOC 2 Type I audit Q2 2025, Type II certification Q3 2026
Your data is encrypted the same way banks protect financial information
Security explained in plain English
Think of Kura Center like a building with separate locked filing cabinets for each facility. Your facility's cabinet has its own unique key. Even if someone broke into the building, they couldn't open your cabinet without your specific key. That's how we keep your data completely separate from other facilities.
Imagine a security camera that records everything, but the recordings are locked in a safe that can't be opened or erased. That's our audit trail. Every time someone views a resident's record, documents a service, or makes a change, it's permanently recorded with the date, time, and who did it. Perfect for inspections.
Encryption is like putting your data in a safe. Even if someone stole your computer or intercepted your internet connection, all they'd see is scrambled gibberish. We use the same encryption that banks use to protect financial information.
Not everyone needs access to everything. Administrators see everything, managers see schedules and reports, and staff see their own schedules and the residents they work with. Just like you wouldn't give every employee the keys to every room in your facility.
When licensing or DDS shows up, you can pull complete, unalterable records in minutes. No scrambling for paper files.
Residents and families can trust that their information is secure and only seen by authorized staff.
Your data is more secure in Kura Center than in filing cabinets or spreadsheets on staff computers.
Complete audit trails and EVV compliance built-in—exactly what DDS requires for QIP.
Know that your facility's data is protected by the same security standards used by hospitals and banks.
All this security happens automatically. Staff just do their jobs—the system handles the security.
Your data is safe. It's stored in secure data centers, not on your computer. You can log in from any device and your data is still there. Just change your password and the thief can't access anything.
We have multiple layers of protection. Even if someone broke through one layer, your facility's data is isolated and encrypted. They'd need your specific encryption keys to read anything—and those are stored separately and securely.
No. Records are permanent and cannot be deleted or altered. If someone makes a correction, both the original and the correction are saved with timestamps. This protects you during inspections.
You own your data. You can export everything at any time in standard formats. No vendor lock-in, no hassles.
Technical implementation details
Implementation: PostgreSQL Row Level Security (RLS)
RLS policies enforced on 40+ tables ensure complete data isolation between facilities. Every query automatically includes facility_id filtering at the database level.
CREATE POLICY facility_isolation ON residents
USING (facility_id = current_setting('app.current_facility_id')::uuid);
CREATE POLICY facility_isolation ON medications
USING (facility_id = current_setting('app.current_facility_id')::uuid);Even with SQL injection or application-level vulnerabilities, cross-facility data access is prevented at the database layer.
At Rest: AES-256-GCM
In Transit: TLS 1.3
Implementation: Append-only audit log table
CREATE TABLE audit_logs (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
facility_id UUID NOT NULL,
user_id UUID NOT NULL,
action TEXT NOT NULL,
resource_type TEXT NOT NULL,
resource_id UUID,
changes JSONB,
ip_address INET,
user_agent TEXT,
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
-- Prevent updates and deletes
REVOKE UPDATE, DELETE ON audit_logs FROM app_user;Every CREATE, READ, UPDATE, DELETE operation logged. Logs retained for 7 years per California Title 22 requirements.
Kura Center is built with HIPAA-ready infrastructure and implements technical safeguards required by HIPAA Security Rule.
AWS BAA: Signed Business Associate Agreement with Amazon Web Services covering RDS, S3, and ECS.
Note: While our infrastructure is HIPAA-ready, full HIPAA compliance requires organizational policies and procedures. If you require a Business Associate Agreement (BAA) with Kura Center, please contact us.
Target: Q1 2025
Target: Q2 2025
Target: Q3 2026
Why We're Transparent: We believe in honest communication about our security posture. Rather than claiming certifications we don't yet have, we're showing you exactly where we are and where we're going.
Our team is here to answer any security or compliance questions