Protecting the people in your care starts with protecting their data
Benol Care handles protected health information, so security isn’t a feature we bolt on — it’s built into how the platform is designed, from how people sign in to how every change is recorded.
Safeguards built into the platform
Encrypted in transit
Every connection to Benol Care is encrypted with TLS 1.2+ and forced over HTTPS, with HSTS, so data moving between your team and our servers can’t be read in transit.
Least-privilege access
Access is scoped to the organization, specific facilities, or individual residents. Each person sees only what their role and assignment allow — on every page and module.
Tamper-evident audit trail
Sensitive actions are written to an audit log. Medication and progress-note entries are append-only: corrections supersede the original and are recorded, never silently rewritten.
Automatic logoff
Idle sessions sign out automatically — the shared-workstation protection HIPAA calls for — with the timeout configurable per organization.
Brute-force protection
Repeated failed sign-ins from an address are rate-limited to blunt credential-stuffing and password-guessing attacks.
Strong authentication
Unique per-user credentials, passwords stored only as salted one-way hashes, a password-rotation policy, and sign-in logging that records the device and IP of each login.
Account controls
Owners and administrators can grant, restrict, disable or block any account instantly — for offboarding, or the moment something looks wrong.
Optional IP allow-listing
Organizations can restrict access to the networks they choose, with a built-in safeguard that prevents an administrator from locking their own team out.
Request protection
Every state-changing request is CSRF-protected, and session cookies are issued HttpOnly, Secure and SameSite to resist hijacking.
Data encrypted in transit and at rest
Every connection is encrypted in transit with TLS 1.2+ and HSTS. Data at rest is protected by full-volume encryption, with automated, encrypted backups, on HIPAA-grade hosting under a signed infrastructure BAA. Particularly sensitive identifiers are additionally encrypted at the application layer with AES-256.
Payments — no card data stored
Subscription payments are processed by Stripe, a PCI-DSS Level 1 provider. Benol Care never sees or stores your card number — card details go straight to Stripe.
A BAA before any PHI
Because we process PHI on your behalf, we put a Business Associate Agreement in place before your account goes live — signed in the app during onboarding. See our HIPAA compliance statement.
Found a security issue?
We welcome reports from security researchers and customers. If you believe you’ve found a vulnerability, please email security@benolcare.com with the details. We’ll acknowledge legitimate reports, investigate, and work to resolve confirmed issues promptly. Please give us a reasonable chance to fix an issue before disclosing it publicly.
See it on your own workflow
We’ll walk you through the platform and get a BAA in place so you can go live with confidence.