Current safeguards
- Encrypted connections. The public website and hosted portal use HTTPS.
- Assigned access. Server-side checks require an active employer or employee assignment. Employees are restricted to their own account and claims. The employer role cannot access individual claim details or claim documents.
- Password sign-in. Employee and employer passwords and recovery are handled through Google Firebase Authentication. The platform validates sign-in tokens and verified email status before granting assigned access.
- Private claim documents. Receipts and supporting bills are stored separately from public website assets. Downloads require authorization, and responses are marked private and not to be cached. Uploads are limited to PDF, JPEG, and PNG, with file size and file-type checks.
- Recorded administration. Claim review, document access, and account changes produce audit entries. Administrator support sessions require a reason, expire after one hour, and retain the administrator’s identity when recording actions on a user’s behalf.
Pilot scope and limitations
DependentCares is in private pilot. This statement is not a certification or an independent security audit. We do not claim SOC 2, ISO 27001, or HIPAA certification.
File-type checks are not malware scanning. This page does not claim independent penetration testing, round-the-clock monitoring, or tested disaster recovery. Retention, deletion, recovery expectations, and incident contacts need to be addressed in each employer’s pilot arrangements. Employers can contact us to review requirements before providing production files.
Report a concern
Email care@dependentcares.com with a brief description of the issue and the affected page. Do not include passwords, access tokens, payroll files, or claim documents. We can coordinate how to provide further information. If you suspect someone has access to your account, change your password and notify your plan administrator.
For information about data use and requests, read our Privacy Policy.