Security summary

This page answers the questions a municipal IT cell, a funder or an NGO board usually asks before records are placed in StrayPaw. It can be printed or saved as a PDF from your browser.

Architecture

StrayPaw is a web application. The application runs on Vercel; data, files and sign-in are held in a managed Postgres database on Supabase. All connections use TLS. There is no software to install: it runs in a browser and can be added to a phone's home screen.

Access control

• Enforced in the database. Row-level security decides every read and write by organisation and role. The interface hiding a button is never the control.
• Organisation isolation. An organisation's records are readable only by its own members. A reviewing office sees only packages submitted to it.
• Roles. Admin, coordinator, veterinarian and field member. Only a veterinarian's own account can authorise a procedure; only an admin or lead can add or remove people.
• Sign-in. An email address and a six-character code sent to that address. No passwords are stored. The sign-in screen does not reveal whether an address has an account, and attempts are rate limited per address and per connection.
• New organisations. An organisation that registers itself is unverified, unlisted and absent from every public page until StrayPaw has checked it.

Integrity and audit

• Every change records who made it and when. Deletions are archived and can be restored by an admin.
• A signed-off procedure is not edited silently: it is returned, corrected and authorised again, and each step stays in the history.
• Imported historical records are labelled as imported and are not counted as verified work until a person confirms them.
• Report packages record every acceptance, query and return with the reviewer and the time.

The assistant (Kaju)

• Kaju reads with the signed-in person's own access and can see nothing they cannot.
• Kaju prepares; a person confirms. It cannot approve a procedure, accept a claim or save a change on its own.
• Today Kaju answers from your records with built-in tools. No record is sent to an AI model provider. Model-backed answers are off, can be switched on only by the owner with a spending limit, and organisations will be told first.
• Records are never used to train AI models.

Privacy

• Public pages show areas, never an animal's exact point. Reporter identity and veterinary notes are private.
• Photos that may show an injury start blurred. Community reports are checked before publication.
• Offline field records are stored encrypted on the phone until they are sent.
• Usage counting is first-party only, with an opt-out; there is no advertising or cross-site tracking.

Data ownership and exit

An organisation owns its records. Registers, evidence and reports export to Excel, CSV and PDF at any time, and a workspace can be deleted on request. See Data processing for sub-processors, retention and incident notice.

Operations

• Changes are deployed from version control after automated checks; database changes are applied deliberately and one at a time, never concurrently.
• The database provider takes managed backups. A restore has not been rehearsed against a recovery-time target; see below.
• Current availability is shown live on the Status page.

What is not in place yet

These are stated plainly so that no tender or review is misled.

• No ISO 27001, SOC 2 or government empanelment.
• No independent penetration test or external audit has been completed.
• The database is not hosted in an Indian region today. Ask us if your contract requires it.
• No published uptime history or service-level commitment outside a written programme agreement.
• No documented, rehearsed recovery-time or recovery-point objective.
• No single sign-on (SAML or OIDC) for organisations.

Reporting a vulnerability

Write to us through the Contact page with the details. We reply, fix and, if you wish, credit you.