9 Security Questions to Ask Before Choosing First Aid Software

First aid software holds more than kit lists. Incident reports carry health information about real people, and training records carry personal details. Before you choose a system, your IT or procurement team will want answers to the questions below. We have included our own answers so you can see what a straight answer looks like.

1. Where is the data stored?

Ask for the country and the city. Australian data held in Australia is simpler for privacy and procurement.

FirstAidLog: in Sydney. The database, sign-in and file storage run in Sydney, and the app and its API are hosted in Sydney.

2. How is one customer kept apart from another?

Look for separation enforced in the database, not only in the screens.

FirstAidLog: each organisation's records are kept apart by row-level security in the database, so one customer can never read another's.

3. What is encrypted?

Ask what is encrypted in transit, at rest, and whether health details get extra protection. Be wary of a web app that claims to be end-to-end encrypted; ask exactly what that means.

FirstAidLog: everything is encrypted in transit and at rest. Incident medical details get a further layer of AES-256 encryption, with the key held in a separate vault.

4. Who at the vendor can see our records?

Support staff sometimes need to look. Ask whether that needs your approval, whether it ends, and whether it is logged.

FirstAidLog: our staff can't open your organisation by default. An Org Admin approves a time-limited grant of up to 24 hours, for a stated reason, and can end it early. Everything staff do shows in your Activity Log under their own name.

5. Who in our own team can see what?

Not everyone needs incident details. Ask about roles and whether you can hide sections.

FirstAidLog: roles for Org Admins, Inspectors, First Aiders and free read-only Viewers. Viewers can't change anything or see incidents, and admins can hide whole sections from a role.

6. Are photos stored?

Photos of injuries or certificates are sensitive and easy to forget about.

FirstAidLog: no. The camera reads text from a certificate, an expiry date or a paper form, and only the text is kept.

7. How are backups done?

FirstAidLog: daily. The last seven days are kept in Sydney, and an encrypted copy goes to separate storage each day.

8. Can we get our data out, and delete it?

You should be able to leave with your records.

FirstAidLog: kits, items, inspections, incidents and audit logs export as CSV or PDF at any time. A deleted organisation goes to Archived first and is removed for good 30 days later.

9. Is there a data processing agreement?

Ask for one, and check the notice periods for new sub-processors and for breaches.

FirstAidLog: yes. Our DPA lists our sub-processors and where they are, gives 14 days' notice before we add or replace one, and commits us to tell you within 72 hours of becoming aware of a data breach, with a first notice that may be preliminary and is updated as we learn more.

Read the full privacy policy, or email support@firstaidlog.com with "Security" in the subject. We reply within one business day.