Security & privacy controls

Separate accounts and scoped access

Each parent signs in to their own account. Database permissions restrict family records to the relevant household and authorised roles. Private notes are separate from shared records. Invited professionals have scoped access rather than unrestricted household membership.

Secure connections and account safety

The public site uses HTTPS and browser security headers. Use a unique password and keep your email account secure. We do not claim that mandatory multi-factor authentication or a particular inactivity timeout is enforced for every member account.

CoParentOS is not an end-to-end encrypted service. Server-side processing and privileged operational access remain possible. Read about administrative access.

Record history and exports

Payment-record and expense-dispute changes are saved with their history in database transactions. File hashes help detect differences in exported bytes; they do not prove that the original content is true or independently verify who created it. We do not guarantee that every action is logged or that a record will be accepted by a court.

Export records you need to retain. We do not offer a guaranteed lifetime archive. See the privacy policy for data handling and request information.

Billing and service providers

CoParentOS uses Supabase for database, authentication and file storage, Vercel for application hosting, Resend for application email, and Stripe for hosted payment flows. A provider’s audit does not mean CoParentOS itself has been audited. CoParentOS does not currently hold a SOC 2 attestation.

Shared subscription coverage does not grant the other parent permission to manage the payer’s invoices or payment details. Payments are processed through Stripe’s hosted checkout.

Testing and reporting

We use automated tests for account isolation and critical record workflows, alongside browser and deployment checks. Testing reduces risk but is not a guarantee that software has no defects.

Report a security concern through Support. Do not include passwords, access tokens or unnecessary family records in your initial report.