Security at Warden

Last updated: 10 October 2026

Warden holds some of the most sensitive records a care home keeps: DBS check details, right to work documents and Deprivation of Liberty Safeguards (DoLS) records about residents. This page says plainly how we protect them today, and what we have not done yet.

Where your data is kept

• Warden runs on a server we operate in Hetzner's data centre in Helsinki, Finland. The database and every uploaded document stay on that server.
• Uploaded documents (certificates, DBS and right to work copies, DoLS papers, notice attachments) are stored outside the website's public folder. Warden only hands a document to a signed-in manager of the same care home, or, for a notice attachment, to a member of staff the notice was sent to.
• Each care home's records are kept apart: the app looks up every record within the signed-in person's own home.

Signing in

• Managers sign in with a password, which we store only as a bcrypt hash. They can turn on two-step verification with an authenticator app, with 10 single-use recovery codes.
• Staff sign in from a single-use link emailed to them. We store the link only as a hash, and it works once.
• A forgotten password is reset through a single-use link that expires.
• Sessions end after 60 minutes without activity, and after 12 hours in any case. Changing a password signs that person out everywhere else.
• After repeated failed attempts at signing in or entering a two-step code, or repeated requests for a password reset or a sign-in link, further attempts are blocked for up to 15 minutes.

Inside the app

• Managers and staff see different things: staff see only the notices, policies and supervisions meant for them.
• An audit log records sign-ins (including failed ones), changes to two-step verification and passwords, data exports, document downloads and changes to records, with the time and the IP address. Managers can view and filter it on the Audit Log page.
• Every form carries a security token, so another website cannot submit it on a manager's behalf.
• Spreadsheet exports are protected against formula injection.
• The browser is told to load scripts, styles, fonts and connections only from Warden and a short list of named services (an enforced Content Security Policy), to refuse framing by other sites, to send other sites only our address as the referrer, and to block access to the camera, microphone and location.

Between you and us

• Warden is only served over HTTPS (TLS 1.2 and 1.3), and browsers are told to use HTTPS for a year (HSTS).
• Emails (sign-in links, notices and reminders) are handed to Brevo over an encrypted connection; Brevo then delivers them to each recipient's mail server, encrypted where that server supports it.

The server

• A firewall lets in only web traffic and our own administrative access. That access uses SSH keys only (password log-in is switched off), and repeated failed attempts are blocked automatically.
• Operating system security updates install automatically every day.
• Scheduled jobs run under the web application's own restricted account, not as the system administrator.

Backups

• Every night we back up the whole database and every uploaded document. Each night's database backup is then restored into a separate scratch database, and the record counts must match, so we know the backup can actually be restored.
• We keep the last 30 nightly backups.
• The backups are on the same server today. An encrypted copy in a second location is on our roadmap below.

Your data, under your control

• A manager can download everything Warden holds for their home at any time, on the Your Data page: one ZIP file with every record as a spreadsheet file, plus every uploaded document.
• Closing the account starts a 30-day period in which you can still download your data or change your mind. After that, everything for the home is deleted, and it leaves our backups within the following 30 days.
• How long each kind of record is kept is set out in our Privacy Policy.

People and process

• Only the Zelicra engineers who run Warden can reach the server, each with their own SSH key.
• Every change is tested on a separate copy of Warden before it goes live, and each live change is recorded with a way to undo it.
• If a personal data breach affects your home's data, we will tell you without undue delay, and within 48 hours of becoming aware of it, as our Data Processing Agreement sets out.

What we have not done yet

We would rather tell you than let you assume. These are planned, with the dates we are working to:

Until then, Warden does not hold Cyber Essentials, ISO 27001 or a DSPT submission, and we do not claim to.

Reporting a security problem

If you think you have found a security problem in Warden, email privacy@zelicra.com with "Security" in the subject. Please do not test against other people's accounts or data. We will reply within one working day.

Warden is provided by Zelicra Technologies Private Limited. See also our sub-processors.