Children's homes hold some of the most sensitive information in society. Arc is designed on the assumption that this data must be protected by default.
We do not treat security as a feature. It is a constraint the system is built around.
Data Ownership
You own your care records.
Arc acts as a data processor for care documentation and as a data controller only for account and billing information. Care data is never sold, mined, profiled, or repurposed.
UK Hosting
All production data is hosted in the United Kingdom. Infrastructure is isolated by environment and access is restricted to authorised personnel only.
Care data is not transferred outside the UK.
Encryption
All traffic to and from Arc is encrypted in transit using modern TLS standards. Data is encrypted at rest within the database and backups.
Sensitive safeguarding records are additionally restricted at application level through structured permissions.
Access Control
Access is governed by strict role-based permissions scoped to company and home level. Users cannot access records outside their assigned home.
Safeguarding records are visible only to authorised safeguarding roles and are not automatically surfaced in general timelines.
All significant access and record changes are logged.
Backups and Resilience
Encrypted backups are created daily and monitored. Restoration procedures are documented and tested to ensure continuity in the event of failure.
Secure Development
Arc is developed using modern security practices, including least-privilege infrastructure access, environment separation, secure password hashing, rate limiting, and regular dependency updates.
Security is considered at design stage, not retrofitted later.
Regulatory Position
Arc is designed to support homes in meeting their statutory record-keeping obligations under the Children's Homes (England) Regulations 2015, the Quality Standards, the Data Protection Act 2018, and UK GDPR.
Arc does not replace professional judgement or regulatory responsibility. The registered provider and registered manager remain responsible for compliance.
Arc is not affiliated with, endorsed by, or certified by Ofsted.
Documentation
A Data Processing Agreement and supporting security documentation are available on request.
Security questions, or need our documentation? Contact us at security@arccare.co.uk.
Other legal pages: Terms of service · Privacy policy · Data security