Secura CMS
Social care management, built in Scotland to Scottish regulation.
Secura CMS records the things an inspection actually asks about, and holds the evidence in a form you can hand straight to the Care Inspectorate.
What it covers
- Adult support and protection
-
Concerns, inquiries and statutory notifications, with separation of duties enforced so the person who raises a concern is not the person who signs it off. Where a member of staff is the subject of a concern, their access to that record is blocked at the database level rather than hidden in the interface.
- Duty of candour
-
Incident recording with the independence rule enforced in the workflow, apology and meeting records, learning actions, and an annual candour report that becomes immutable once published.
- Medication
-
Administration records, refusals and omissions with reasons, and competency gating so only staff signed off for a task can record it.
- Daily care recording
-
Running notes written by typing or dictation, with photographs and body-map marking. Dictation is transcribed without a transcript being retained on our servers.
- Monitoring charts
-
Food and fluid intake, repositioning and turning, and hydration, with an escalation sweep that flags a chart falling behind rather than waiting for someone to notice.
- Access and competency
-
Access scoped to the service a person works in, with competency sign-off required before a task can be recorded against a person receiving care.
Regulatory grounding
Every consequential rule in the system carries a provenance marker recording whether it comes from statute, from regulator guidance, from professional judgement, or from a data protection decision. That register is available to inspectors and to your own governance leads.
The behaviour of the system is held in place by an executable suite of several hundred regulatory invariants, run on every change. A rule that matters is a test that fails when it is broken, not a line in a manual.
How it is built
| Data separation | Each organisation's records are isolated by row-level security in the database, enforced for every role including the application's own. Separation does not depend on application code being correct. |
|---|---|
| Encryption | Personal and special category data encrypted field by field with AES-256-GCM. Encrypted in transit throughout. |
| Audit | Append-only. Care records cannot be silently altered or deleted; corrections are recorded as corrections. |
| Hosting | United Kingdom — AWS London (eu-west-2). No data transfer outside the UK. |
| Sign-in | Secura SSO, including multi-factor authentication and passkeys. Can federate to an identity provider you already run. |
| Data protection | A maintained DPIA register covering each processing activity, available to commissioners on request. |
Where we are
Secura CMS is in development and not yet available for deployment. It has no customer and is under no contract. We are saying so plainly because a care provider needs to plan around real dates, not a demonstration.
The platform is built to production standard across its core modules, against what the Care Inspectorate and Scottish legislation publish rather than against a signed specification, and is held in place by an executable suite of several hundred regulatory invariants. What remains is hardening, accessibility testing, and a first supervised deployment.
We are looking for a small number of care providers and commissioning partners to shape it before general release. An early partner gets the product at cost, direct influence over what gets built next, and an exit that costs nothing but time.
Interested in being an early partner? Email info@cairnova.io. We would rather show you an honest work in progress than a demonstration that hides the gaps.