Encrypted in transit and at rest
Every connection runs over TLS. Data and uploaded documents are encrypted at rest by the underlying managed Postgres and object storage infrastructure.
Security and privacy
Data should serve dignity, not the other way around.
MissionWoven holds records about people in some of the hardest moments of their lives. Here is precisely how that information is protected, in plain language, including the things the platform does not do.
Three layers of tenant isolation
Every record carries an organization identifier. Isolation is enforced by request filtering, by Postgres row-level security policies, and by organization-scoped tables rather than shared global ones. One layer failing does not expose another organization's data.
You decide whether names exist
The participant identifier system supports full de-identification, where no participant name is stored in the system, and the name-to-identifier key stays a physical document held by your organization. Outcome tracking and reporting work identically either way.
Roles, not a shared password
Every staff member signs in with their own email address and password. Access is scoped by role, and removing a person removes their access without disturbing the records they created.
Documents scoped to your organization
Files in the document vault are stored in a per-organization path with access policies that reject reads from outside that organization, enforced by the storage layer rather than by the application alone.
Your data leaves when you do
Full export is available on every plan at any time, including your custom program configuration. Data ownership is stated in the subscriber agreement, not just in marketing copy.
Tenant isolation
Three layers, not one.
Isolation between organizations is the single most important property of a shared platform, so MissionWoven does not rely on any one mechanism to enforce it.
1. Every record is scoped
Every row in the database carries an organization identifier. There is no unscoped table anywhere in the schema, including programs, which are organization-owned rather than global.
2. Every request is filtered
The application filters by organization on every read and every write. A request cannot ask for another organization's records, because the identifier comes from the authenticated session rather than from the request.
3. The database enforces it independently
Postgres row-level security policies reject cross-organization reads at the database layer. If application code were ever wrong, the database still refuses.
The identifier system
You can run a full case management platform without storing a single name.
Under full de-identification, a participant receives an identifier at intake in the format your organization defines, and no name is written to the system at all. The key that maps names to identifiers stays a physical document, held by your organization, under your control.
Sessions, outcomes, follow-up, and grant reporting all run against the identifier, so nothing about your reporting gets weaker.
If your work does not call for that, choose names alongside identifiers, or plain named records. It is your decision to make, per organization.
Operating practices
How the platform is run.
The operational detail your board, your auditor, or your funder will ask for during a review.
Where the data lives
Application and database infrastructure runs in United States regions on managed cloud providers. Data is not moved outside the United States.
Backups
The managed database provider takes automated backups on a continuous schedule. Organizations can also take their own export at any time from the data backup module.
Access by MissionWoven staff
Administrative access to production is limited to the smallest number of people needed to operate the service. MissionWoven does not access participant records to build features or train models.
Subprocessors
MissionWoven relies on a short list of infrastructure providers for hosting, database and authentication, file storage, transactional email, and payment processing. The current list is available on request and any addition is communicated to subscribers in advance.
Incident response
If a security incident affects your organization's data, MissionWoven notifies the administrative contact on your account promptly, with what is known, what is affected, and what is being done.
HIPAA and protected health information
MissionWoven does not currently offer a business associate agreement. If your programs handle protected health information under HIPAA, contact us before you subscribe so we can confirm whether the platform fits your requirements.
Have a question your board will ask?
Send it. Security questions get answered by a person who knows the architecture, not by a form letter.