Security and data handling
A page you can forward to your funder.
Structural facts about how COMPASS handles client data, and a plain list of the things we do not claim. Short on purpose. A long security page usually means somebody is padding.
Who can see what
Access in COMPASS is granted capability by capability rather than by job title. There are more than 200 of them, and an organization sets its own combinations without asking us.
Capabilities, not rolesA bookkeeper can approve expenses without seeing pay rates. A volunteer coordinator can see schedules without seeing client records. Job titles in COMPASS are labels; the access sits on the capability.
How organizations are kept apartAll organizations share one database, and every record carries the organization it belongs to. Requests from the browser go through the database's row-level security, which limits them to the user's own organization. Server functions run with full database access and check the organization in their own code, so for them the check is application code rather than the database.
Substance use and mental health have their own permissionsSubstance use answers need one permission, and mental health and HIV answers need another, apart from the rest of the client record. That covers the HUD and youth (RHY) assessment answers, the Coordinated Entry answers that ask about them, a client's own check-in answers about substance use and medication, and any case note or document marked as either. Without the permission, a marked note or document does not appear at all, and saving an assessment cannot overwrite an answer the person cannot see. Browser requests are held back by the database; server functions check in their own code.
Break-glass is written downSomeone holding the override permission can open one client's protected records for one hour. They have to write down why, the opening is logged with that reason, and the organization's administrators are told. New organizations do not get this permission by default.
42 CFR Part 2 recordsCOMPASS does not accept substance use records covered by 42 CFR Part 2 unless illumipath has agreed in writing to receive them. Where it has, COMPASS records the patient's signed consent with every element 42 CFR 2.31 requires. Part 2 items go to the county HMIS, or to a partner organization, only while a consent naming that recipient is in force, and each release to the HMIS is logged.
Sign-in limitsThirty minutes without activity signs a person out, with a warning first. Five wrong passwords lock the account for fifteen minutes.
Nothing quietly disappears
Case notes and time entries are attested records. Somebody signed them, a funder may audit them, and payroll may depend on them. COMPASS treats them that way.
| Edits create versions | Session logs, case notes and time entries are versioned. An edit writes a new version and preserves the original rather than overwriting it. |
| Deletions leave a marker | A deleted record leaves a tombstone. You can tell that something was removed, and when, rather than finding a gap. |
| Editing a signed record clears the signature | Change a signed timesheet and the signature comes off. It has to be signed again. A signature in COMPASS always refers to what is actually in the record. |
| Separation of duties | A form cannot be cosigned by the person who started it. Enforced by the system rather than by policy. |
| Audit trail | Significant actions are logged with the user, the timestamp and the detail. Exportable, and the retention period is yours to configure. |
What we do not collect
No tracking in the appThe COMPASS application runs no analytics, no advertising and no tracking of any kind. Not a reduced amount. None.
This site is cookielessOur marketing site uses privacy-preserving analytics with no cookies, no client-side storage, no fingerprinting and no cross-site tracking.
No client data will reach a payment processorThere is no billing yet. When there is, it will carry your organization name and an identifier, and no client record will ever touch it.
What we are not claiming
Most security pages are a wall of badges. Here is the other list, because a vendor who tells you the limits before you ask is easier to check than one who does not.
Notes are protected when marked COMPASS does not guess from the type of service. A case note or document is protected once someone holding the permission marks it, and a note written before October 29, 2026 stays unmarked until someone does.
Some answers still hint The HUD disabling-condition answer stays visible to anyone who can see the client, and a yes there can suggest that a hidden answer is yes. A few Coordinated Entry questions that touch drug use or health stay visible on purpose, such as the count of medical conditions in a household.
Break-glass reads are not itemized The opening is logged, with its reason. What the person then reads in the browser during that hour is not logged record by record.
No SOC 2 report There is no audit and no report. If a funder requires one, we are not the right answer today and we will tell you that on the first email rather than the fourth.
No HIPAA attestation For most homeless services data the governing regime is HUD and HMIS rather than HIPAA. If your situation is genuinely a HIPAA one, that is a conversation with a person and not a checkbox on a page.
No uptime guarantee We do not offer a service level agreement and we do not publish an uptime figure. Quoting one we have not committed to contractually would be marketing rather than a promise.
No implementation details We do not publish specifics about encryption schemes or credential storage. Publishing them helps an attacker more than it helps you evaluate us, and the structural facts above are the part you can actually check.
Has a funder sent you a security questionnaire?
Send it over. We will answer it directly, including the questions where the honest answer is no.
Where to go next
Get on the list COMPASS is not open to new organizations yet. Leave your name and you hear once, when it is. What your HMIS Lead receives The HUD CSV export in detail, including the parts that are not built and the sync we do not do. Who else touches your data Every company we rely on to run COMPASS, what each one does, and what actually reaches it. Forwardable to a funder.
Or put the question to a person instead of reading three more pages. hello@illumipath.io