Protected records
If your work involves safeguarding — or anything else that has to be handled more carefully than the rest — the question isn’t whether the software has a form for it. It’s who can open a report once it exists, where it’s kept, and what the system deliberately doesn’t do with it.
A separate path, not a separate product · isolation here is never a setting
The separation
Not a tickbox, and not a folder with tighter permissions. From the form it arrives on to the table it lands in, it never touches the rest of your data.
A report goes in through its own form, is handled by its own workflow, and lands in a table of its own. It’s never written in alongside everything else, so there’s no list it can accidentally turn up in.
Your dashboards, tables, searches and exports are all built from your day-to-day work. A protected report isn’t part of that, so it can’t be swept up by a query written for something else.
The red assistant answers from your day-to-day work only. It won’t surface, summarise or count protected reports, whoever asks and however the question is worded. That path is kept out of what it can fetch at all, rather than filtered out of the answer afterwards.
Most of this platform is configured per client. This part isn’t. There’s no tier, setting or option that relaxes it, and that includes for us.
Access
A short, named list — and it’s granted as a specific permission rather than inherited from a job title.
Access is its own permission rather than something bundled into being an administrator. You can give it to a designated safeguarding lead without making them an admin, and hand someone admin work without handing them this.
Every decision inside your portal belongs to your own admin. red-route sets it up, hosts it and maintains it. We don’t act inside your portal as you, and we don’t make your safeguarding decisions.
Raising a concern never needs a login. The public form stays reachable without one, so someone who can’t get in — or won’t wait — still has a way to report. The restriction is on who can open a report, never on who can make one.
Who submitted a report, when, and every status change afterwards is recorded and kept. When someone comes to check how a concern was handled, the answer isn’t somebody’s memory.
What it does not do
Deliberately. A concern is handled by people, following your policy. The software’s job is to capture it reliably, restrict it properly, and then stop.
There’s no conversation about a case inside the portal, because a chat history is a case file nobody agreed to keep. Once a report is in, follow-up happens by email to your monitored inbox or your named lead — where your policy already says it should.
The portal tracks a report as submitted, in progress or closed, and nothing more. What was said, what was decided and what was done live in your own process. We hold the fact of the report, not the substance of it.
How long reports are kept is your decision, written down when we set you up rather than inherited from a default nobody chose. You’re the controller; we’re the processor acting on your instructions.
red-route is a platform that handles protected information properly. It doesn’t triage, advise, escalate or take on any part of your duty of care, and it’s no substitute for a trained lead.
The tier
It’s the level of managed service and compliance, not a bigger computer — and not because the data belongs to a charity.
Your data sits in its own encrypted database with its own key, shared with no other client. We hold that key as your processor. When you leave, we destroy it — and your data becomes unrecoverable, in the live system and in every backup.
A recorded history of who did what and when, and a firmer commitment on response when something’s wrong. These are the things a duty of care actually asks for when somebody comes to check.
Signed before go-live, with documented security measures, naming what we hold and on whose instructions. Information about people carries a legal duty of care, so it’s settled in writing first rather than bolted on later.
The separate database, the restricted access, the local-only assistant and the UK hardware aren’t tier features. What the higher tier buys is the assurance around them — not whether your data is properly separated.
We’ll show you where a report goes, who can open it and what the agreement says, before you commit to anything. General data handling is on the security page.