Porchlight for Communities

Security at Porchlight

Residents trust their life stories to Porchlight, and communities trust us with the data of the people in their care. This page describes, plainly and without exaggeration, how that trust is protected. Questions are welcome any time at team@levelbrook.com.

Encryption

In transit: every connection to Porchlight — staff dashboard, resident app, family relay, and our own administrative access — is served exclusively over HTTPS (TLS 1.2+). Traffic is additionally fronted by Cloudflare's edge network.
At rest: audio recordings and photos are stored in cloud object storage with provider-managed server-side encryption. Application databases live on encrypted volumes on our servers.

Access model

Tenant isolation. Every community's data is scoped to its own organization; staff accounts can only ever read or write their own community's residents, stories, and families. This isolation is enforced in the application's data layer and covered by our automated test suite.
Residents access only their own interview app, through an unguessable per-resident link (no passwords to lose). Family members access only their own resident's relay page through a private link, with an optional page password they control.
Consent is structural. Nothing is recorded until the resident has agreed to take part; every resident and family signature is stored as an immutable, versioned consent record. Withdrawal is honored immediately.
Our own access is limited to a small number of named operators. Administrative actions — including any support access to a community's account — are written to a persistent audit log.

Backups & continuity

Application data is persisted on durable storage that survives every deployment, and media is stored redundantly by our cloud storage provider.
Backups are taken regularly and tested against restores as part of normal operations.

Data retention & deletion

A community's data is retained while its account is active.
When a community leaves, we delete its data within 60 days of a written request (or automatically after the account is closed), except records we're legally required to keep (for example, billing records and consent evidence).
Any individual resident or family member can be deleted by community staff at any time, which removes their recordings, transcripts, and derived content.

Development practices

Changes ship through code review and an automated test suite that includes tenant-isolation, consent, and permission tests.
Secrets are never committed to source control; production credentials are injected at deploy time.
Login, signup, and password endpoints are rate-limited; sessions are cookie-based, encrypted, and reset on sign-in and sign-out.

Third parties

We use a small number of infrastructure providers (hosting, storage, transcription, email, billing) — the current list, and what each one touches, is always published on our subprocessors page. Each processes data only to provide its service to us.

Reporting a concern

If you believe you've found a security issue, email team@levelbrook.com with the details. We read every report and respond quickly.