Security and data protection
Built so a child's data never needs to be here.
The information your governance team will ask about, in one place: what we hold, what we never hold, and how it's protected.
What CuraIQ holds
- Non-identifying need profiles (age band, region, type, legal status, need flags)
- Professional user accounts (council, provider, care staff)
- Home listings and verified Ofsted ratings
- Referral status and a reference number
What CuraIQ never holds
- A child's name, initials or date of birth
- Addresses, schools or case notes
- The full referral or any attached reports
- Free-text descriptions of a child
How data flows
Two stages, two channels.
Council
Placement team posts a need
Non-identifying fields only
Stage 1 · on CuraIQ
Matching and responses
Verified providers only
Stage 2 · off-platform
Full referral by secure email
Egress, Microsoft 365 or similar
Controls
How the platform is protected.
Government-only sign-up
.gov.uk, .gov.wales or .gov.scot addresses, enforced on the server.
Provider verification
Every provider checked before they can see or respond to needs.
Private locations
Street addresses never shown. Photo location data stripped.
Hosting
[Confirm hosting region, e.g. UK or EU data centres]
Encryption
[Confirm: in transit (TLS) and at rest]
UK GDPR roles
[Confirm controller and processor roles]
Certifications
[Only list certifications CuraIQ actually holds, e.g. Cyber Essentials, DSPT]
Questions from your IG team?
We'll talk them through the platform and share our documentation.