Security
Built to keep family billing safe.
Payments run on Stripe
Families enter card and bank details in Stripe’s secure checkout, and Stripe handles PCI compliance. Card and bank numbers never touch CareVieo servers. Money goes straight to your agency’s own Stripe account.
Encryption
Data is encrypted in transit (HTTPS) and at rest by our hosting providers. QuickBooks Online connection tokens are additionally encrypted before they are stored.
Access controls
Each agency’s data is separated at the database level. Inside your agency, only owners, admins and billing staff can manage billing, imports and payment settings.
Secure family links
Family payment links are long random links that can expire and be revoked; we store only a scrambled (hashed) version. Each family sees only its own invoices — and on split bills, only its own share.
Audit logs
Billing changes such as manual payments, invoice status changes, autopay and split-bill changes are recorded with who made them and when.
BAA included
A Business Associate Agreement (BAA) is included with CareVieo Pay.
Billing-only records
Payers need only billing details — name, contact, address and notes. No clinical fields are required, and Stripe and QuickBooks Online receive only what they need to take or record a payment.
Report a vulnerability
Email security@carevieo.com with details and steps to reproduce.