Roles for each job
Intake, caseworker, program manager, instructor, records manager and more. Each role sees only what its work needs.
Restricted records
A restricted case is open only to its caseworker, named colleagues and people with an approved grant. It doesn’t show in searches or counts.
Passwords kept as hashes
Cairn stores passwords only as one-way hashes. Nobody, administrators included, can see a password.
Limits on wrong guesses
Five wrong passwords lock sign-in for 15 minutes. A reset link works once, for 30 minutes.
One session per person
Signing in somewhere new signs you out elsewhere. Sessions end after 30 minutes without use.
Guarded public forms
The application form limits how often one address can send, and quietly drops automated submissions.