Security & Trust
Security built into advisory, care, funding, and platform workflows.
A practical, security-informed approach to protecting client information, platform access, operational workflows, and advisory delivery.
Contact NorthernEdgeSecurity Snapshot
- Role-based access model
- Row Level Security
- Secure intake workflows
- Production security headers
- No public exposure of private data
- Transparent compliance position
Security Overview
NorthernEdge is building its advisory platform and operating model with security, privacy, accountability, and responsible data handling in mind from the ground up, not added as an afterthought.
Whether you're a healthcare organization, a public-sector agency, a community partner, or a family working with us directly, this page explains, in plain business language, how we approach protecting the information and access involved in that work.
Platform Security Foundations
Role-Based Access Control
Platform access is structured by user role, such as admin, staff, client, caregiver, and partner, so each person only reaches the information appropriate to their role.
Row Level Security
Database access is restricted at the individual record level, helping ensure users only see the specific records they're authorized to access, not just broad category-level permissions.
Protected Admin Area
The administrative area is access-controlled and intended only for authorized internal NorthernEdge users, separate from client-facing systems.
Authentication & Session Handling
Authenticated sign-in is required to reach private dashboard and admin areas, with session handling designed to support secure, ongoing access to protected services.
Audit & Activity Logging
The platform architecture includes activity tracking, supporting accountability and the ability to review what happened and when.
Secure Contact & Intake Workflows
Contact and intake submissions are structured, stored through access-controlled systems, and routed appropriately, avoiding unnecessary public exposure.
Production Security Headers
The production website uses modern security headers designed to help reduce browser-based risks such as clickjacking, MIME sniffing, insecure referrer leakage, and unnecessary browser permissions.
Least Privilege Principle
The platform is designed around giving users and systems only the minimum access required to perform their specific role, not broad default access.
Privacy and Responsible Data Handling
Purposeful Collection
Data is collected only for legitimate service delivery, not broad or unnecessary collection.
Careful Handling
Sensitive information is handled carefully throughout an engagement.
Role-Based Access
Access is limited to authorized users based on role.
No Public Exposure
Client information is not exposed publicly.
This page describes our practices and approach. It is not a legal guarantee or a substitute for a formal data processing agreement, which can be discussed directly for specific engagements.
Cybersecurity Advisory Alignment
Our own security posture directly informs the broader cybersecurity readiness services we deliver to clients.
Gap Assessments
Cybersecurity gap assessments for your organization.
Cyber-Insurance Readiness
Preparation for cyber-insurance requirements.
Microsoft 365 Advisory
Security configuration and advisory for Microsoft 365.
Incident Response
Policy and incident response readiness.
Risk and Control Review
Structured review of risks and controls.
Governance Support
Security awareness and governance support.
Procurement-Friendly Security Commitments
- Role-based access model across the platform
- Record-level data protection, not just table-level access
- Protected admin workflows, separate from client-facing systems
- Secure-by-design development approach
- Privacy-conscious service delivery
- Documentation and accountability built into how we work
- A continuous improvement mindset, not a one-time setup
- No public exposure of private platform data
Current Security and Compliance Position
NorthernEdge is building its platform and operating model with strong security, privacy, and governance practices. We do not currently hold formal third-party certifications such as SOC 2, ISO 27001, HIPAA, or PHIPA compliance status.
If formal certifications are pursued in the future, that status will be communicated clearly and accurately. NorthernEdge does not represent certification status unless it has been formally achieved. We believe this transparency matters as much as the practices themselves.
Stronger security begins with clear visibility.
Practical controls and accountable delivery, built into every engagement.