Security & data handling
Care data deserves better than a shared database.
This page is the plain-English version of how Corella handles your organisation’s data. If you want more detail than what’s here, ask us and you’ll get a straight answer.
The audit log: read-only, newest first — who did what, and when
The structural difference
Isolation isn’t a setting. It’s the architecture.
Every Corella provider gets their own instance: their own application, their own database, their own subdomain, their own branding. The wall between your data and anyone else's isn't a permission check — it's separate infrastructure.
In practice
What we do, in plain English.
One database per provider
Your instance runs against its own database with its own credentials. There is no shared table, no tenant column, no 'filtered view' of a communal pool — your data and another organisation's data are structurally separate.
Hosted in Sydney, Australia
Your instance, its database and your uploaded files live in Australian data centres (DigitalOcean, Sydney). Care records don't leave the country to be stored.
Where the AI processing happens
Corella's AI features are switched on by your organisation when it chooses — the paper-form reader in the form builder included, which reads only the blank form someone chooses to upload. When they're on, the text being analysed is sent to our AI provider in the United States. For a client summary that means conditions, allergies, behaviour support notes, recent incidents, recent progress notes and the office-only notes on that person's record — the most sensitive thing Corella sends anywhere, which is why it belongs on this page and not in a footnote. A letter drafted from the record sends the same kind of material: the person's record for the last twelve months, office-only notes included. “Ask about Corella”, the in-app help, sends a staff member's question — where to change something, what a screen is for — with emails, links, long numbers and your people's full names taken out first, and the question isn't stored. It answers from Corella's own guide, with no access to your records. The provider's commercial terms prohibit training models on customer content, so nothing you send is used to train anybody's model. Your records themselves are stored in Sydney. If you want the provider's data-handling terms before you switch it on, ask and we'll send them.
Voice notes, meetings and recorded visits — where the audio goes
Dictation, meeting recording and the visit scribe are separate switches, each turned on by you. When they're on, the audio is transcribed by a specialist provider in the European Union. As soon as the text comes back, your instance instructs that service to delete both the recording and its copy of the text — on the meeting, dictation and visit-scribe paths — and a dictation clip abandoned part-way is deleted too. Corella's servers do not keep the recording; one that can't be sent straight away waits on the phone that made it, and is deleted after 7 days, the next time Corella is opened on that phone. Only the resulting text is kept, in your organisation's own Corella database in Sydney. With meeting summaries on, that text — names included — goes to our AI provider in the United States to draft the summary, and staff check it before it enters a record; with the visit scribe on, it goes there to draft the visit's note, which the worker reads back and saves or discards — and the person being visited signs recording permission first. Because this is a cross-border disclosure, you should name speech processing in your own privacy policy and participant agreements — and Corella drafts that wording for you: Settings → Voice & meetings hands you a copy-ready privacy-policy clause, a service-agreement clause, and the sentence staff say before recording a meeting, each filled in with your organisation's details. The transcription provider's terms are available on request.
Roles with real walls
Four built-in staff levels scope what people see and do, and an organisation can build its own roles on top of them — starting from a built-in level and choosing area by area how far it reaches, so a senior clinician can keep the clinical picture without seeing invoicing. Your administrator switches custom roles on, and then every area follows them. Support workers see only the clients they're rostered with, and only the need-to-know essentials — office-only fields and one-way private notes stay with the office. An office-only note stays in the office: a worker on the shift sees neither its words, its subject nor that it exists, and a Care Signal raised from one reaches only the team leaders and safeguarding leads who can already read office-only notes.
Files behind the login
Documents and photos are stored per-organisation and served only through your instance's authenticated proxy — there are no public file links to leak.
Backups you could actually use
Databases are backed up daily with point-in-time recovery. Backups are the platform's job, done on managed infrastructure — not a cron job on a box in a cupboard.
An audit log of who did what
Actions across the system are recorded — who created, changed or approved what, and when. When a question comes up months later, the answer is in the log, not in memory.
Watched for errors
Every instance reports errors to monitoring the moment they happen, and uptime checks page us if your instance stops answering. Problems get found by us, not by your Monday morning.
Sessions that re-check themselves
Logins re-verify a person's role and active status against the database on every sensitive action — deactivating a departed staff member cuts their access, immediately.
Two-step sign-in, when you want it
Anyone with a password login can switch on two-step sign-in from their own profile: after the password, the six-digit code from any authenticator app on their phone, with ten single-use recovery codes for a lost phone. Your organisation can require it of administrators and finance staff, or of everyone who signs in, whenever you choose, and someone who has to set it up is taken to do that at their next sign-in. Five wrong codes pause the second step for 15 minutes, and each code works once. A Microsoft sign-in follows your own organisation's policy. The one login we use to help you inside your instance needs a code as well as its password on every instance, and Settings → Security → Platform access shows that, beside when it last signed in and everything it has done.
Ask us anything: you’ll get a straight answer.
Any question about how your data is stored, who can access it, and how you’d get it back is answered directly, by the people who run the platform — with the detail behind every statement on this page.
See your organisation in Corella.
A 30-minute walkthrough of your own workflows, in your own terminology — not a canned demo.