Data security

1. Who can see what

• Owners see everything in their own nursery, and nothing in any other.
• Educators see the children in their nursery, to do their work.
• Parents see only the children linked to their account: their diary, attendance, photos and messages, and the posts the nursery shares with them.
• Messages about a child are only visible to that child's parents and the nursery.

These rules are enforced inside the database, not just in the app's screens. Even if someone changed the app on their phone, the database would still refuse to hand over records they aren't allowed to see.

2. Accounts and sign-in

• Educators and parents can only join by invitation from their nursery.
• Passwords must be at least 8 characters, and are stored scrambled so that nobody, including us, can read them.
• Sign-in and sign-up pages check that a person, not an automated program, is trying to get in.
• When an educator leaves, the owner switches their access off, and they're signed out the next time they open Nuru.

3. Encryption and storage

• Everything travelling between your device and Nuru is encrypted (HTTPS).
• The database and file storage are encrypted at rest.
• Photos are kept in private storage. They're shown through links that expire after an hour, so a copied link stops working.
• The database and files are stored in the European Union (Ireland).

The keys that give full access to the database are kept on our servers only, never in the apps on people's phones.

4. Our own access

Only the people who build and support Nuru at Databit Limited can reach the systems that hold records. They look at records only when it is needed to fix a problem or answer a nursery's request, and they're bound by confidentiality.

5. If something goes wrong

If we discover a breach affecting a nursery's records, we tell the nursery without delay, work to stop it, and help the nursery tell the Office of the Data Protection Commissioner within 72 hours and the families affected where needed. Our data processing agreement sets this out in full.

6. Found a problem?

If you think you've found a security weakness in Nuru, please email hello@nurucare.app before telling anyone else, and don't try to reach other people's records. We'll reply, keep you updated and thank you.