The simple staff credential and compliance tracker.

Yes, and the reason is architectural rather than a promise. Every row in the database carries the id of the facility it belongs to, and Postgres row level security decides on every single read and write whether the person asking is a member of that facility. There is no application server sitting in between that could be misconfigured into skipping the check. The browser talks to the database and the database enforces the rule.

Everything is encrypted in transit and at rest. The site sends strict transport security and a content security policy that only allows scripts from our own origin, and it refuses to be loaded inside a frame on another site.

On 2 September 2026 the isolation was re-checked by asking the database rather than by reading the policies: 45 probes, as an anonymous visitor with no login, as the owner of a different facility reaching for this one, and as a Credolex admin without a support session open. Every cross-facility probe returned zero rows.

No. Three separate things have to be true for that, and all three are enforced by the database:

• Row level security is switched on for every table in the schema, 17 of 17, and every read policy on staff data is scoped to the facilities you are a member of. Not most of them. All of them.
• Every computed view, including the status engine that decides what is expired and what is due, runs with security_invoker, so it inherits your permissions rather than the database owner's. This is the one place where every policy can be right and the product still leaks, so it was verified on each view individually.
• A record cannot even point at a person in another facility. A composite foreign key refuses the write.

Membership can only be granted by an existing owner of that facility, and creating a facility with its first owner happens in one transaction that no other path can reach.

The shortest safe database is the one that never holds the sensitive thing in the first place.

A health screening entry is a date and a status. A tuberculosis test is "tested, 14 March 2026." A hepatitis B declination is "declined, on file." The reason is never asked for and there is nowhere to put it.

The honest answer is that the question usually does not apply here, and we would rather explain that than put a badge on the page.

Credolex is not a covered entity. Employment records that an employer keeps in its role as an employer are excluded from HIPAA's definition of protected health information, and Credolex holds nothing else: no resident charts, no clinical data, no patient identifiers, by design rather than by policy.

If your counsel decides that what you want to put in Credolex does include protected health information, email support@credolex.com and we will execute a Business Associate Agreement before you enter it. That obligation is written into the Terms of Service, section 10.4, not just into a sales conversation.

Separately: employee health screening dates are employee health information under several state privacy laws even when HIPAA does not reach them, and our Consumer Health Data Privacy Policy covers how they are handled.

There are no passwords, so there are no passwords to steal, reuse or leave on a sticky note at the nurses' station. Signing in means clicking a one-time link sent to a work email address, and only addresses you have invited can request one. The server refuses self sign-up outright.

Anyone can enrol an authenticator app from Settings. Once they have, the emailed link on its own is no longer enough to see anything.

When someone leaves, an owner removes them and their access ends at the next request. Roles are enforced in the database, not hidden in the interface: an owner can change anything, staff can record dates, and read only means read only even to somebody going around our screens.

Yes, and this is the answer surveyors actually care about. Every change to a person's file is written by the database itself to an append-only log: who made it, what changed, and when.

Nobody can edit or delete that log through the application. Not staff, not an owner, and not the person whose own action it records. So "this certificate was updated on the 14th" is something you can show rather than something you have to remember.

One Postgres database hosted by Supabase in AWS us-west-1, Northern California. It never leaves the United States.

Four subprocessors, and that is the entire list: Supabase for the database, Resend to send the reminder emails, Cloudflare to serve the site, and Healthchecks.io for the heartbeat that tells us if the nightly reminder job did not finish. No advertising networks, no analytics vendor watching your staff, nobody buying the data. The current list is published at credolex.com/subprocessors.

Credolex support cannot browse your facility casually. Looking into it takes an account flagged as staff in the database, a second factor that no administrator can waive, and a support session opened against your facility with a written reason, which expires after an hour. The few administrative things we can do on request, such as adding a colleague to your account, need that same open session. Every one of them lands in your facility's own change history with the reason attached, so what we did and why is something you can read rather than something you have to trust.

Your roster and every date recorded against it export to a spreadsheet from Settings, whenever you want, without asking us and without a support ticket. There is no hostage-taking version of this product.

To leave, an owner emails support@credolex.com and we delete the facility and everything in it within 30 days, and confirm when it is done. After an account ends, data is removed from production systems within 90 days and from backups as they expire.

Two audiences, and the second one is the part people do not expect.

• The employee gets their own email. If you put a work address on someone's file, the reminder goes to them directly at 30, 15 and 7 days and on the day it expires. The CNA whose BLS card is running out hears it from Credolex, not from a coordinator who has to remember to walk down the hall.
• Your notification address gets one digest a day. One email, listing everything that reached a reminder point that day, across the whole building.

That is the actual difference between this and a calendar reminder. The person who has to go renew the thing is the person who finds out.

Their first name, the requirement, your facility's name and the date. Word for word, this is the whole message:

No screening result, no reason, no note your staff typed, and nothing about anybody else on the roster. If several of one person's items land the same night they get one email listing them, not four.

No, and the design is deliberate about it, because an alerting tool that gets ignored is worse than no alerting tool.

The coordinator digest is one email a day. It lists only what newly crossed a reminder point that day, and it is not sent at all on days when nothing moved. An item that is already on your dashboard does not queue a fresh email every night just for still being there.

Nothing goes out, which is the only humane way to handle it.

A facility that imports a roster carrying forty lapsed certificates should see forty red rows on its dashboard, not send forty emails to forty people about things that lapsed last year. On your first run that standing backlog is written to the record already closed: it is on the books, it is visible, and nobody is mailed about it. Reminders begin with what moves after you are set up.

The email address is optional and plenty of rosters do not have one for every aide. That person still appears on your dashboard and still appears in the coordinator's daily digest, exactly like everyone else. They simply do not get their own copy, and the record notes why.

If an address stops accepting mail, Credolex stops after three failed attempts rather than retrying forever, and the failure is on the record instead of quietly disappearing.

Thirty-three requirements ship built in, across four kinds of expiring thing:

• Licenses and certifications. RN, LPN and CNA licenses, BLS and ACLS cards, CPR, certified medication aide, and the rest.
• Health screenings. Tuberculosis testing, respirator fit testing, hepatitis B status, influenza season status.
• Background and registry checks. Criminal background checks, abuse registry and exclusion list screening.
• Training and in-service hours. Annual in-service hours, abuse and neglect prevention, infection control, HIPAA privacy and security training, dementia care.

Each one cites the federal tag or state code behind it, so when somebody asks why a requirement is on the list, the answer is on the requirement. You can add your own on top for anything your state or corporate office requires.

No, and we would rather say so on the homepage than let you find out later.

Credolex is a record-keeping and reminder system. It tracks the dates you enter and it tells you before they run out. It does not query any licensing board or exclusion registry, it does not confirm that a license is real or in good standing, and it does not give legal, regulatory or clinical advice. Your facility remains responsible for its own compliance and for the accuracy of what it enters.

What it removes is the failure mode that actually gets facilities cited: a valid credential that quietly expired because the spreadsheet was nobody's job.

A spreadsheet stores dates. Credolex watches them.

A spreadsheet is correct on the day you update it and silent every day after. It cannot tell you that Priya's background check lapsed on the 21st, and it cannot email Priya. Every spreadsheet system in this industry is really one person remembering to open the file, which works until that person is on vacation, out sick, or has taken a job at the building down the road.

Credolex reads the dates every night and sends the email itself. Nothing depends on anybody remembering.

You import the staff spreadsheet you already keep, so the roster arrives in one step rather than one person at a time. From there you enter each date once, when a credential is renewed, and Credolex handles every reminder that date generates from then on.

There is nothing to scan and nothing to upload. It is typing a date into a field, and it is the last time you have to think about that date.

Directors of nursing, staffing coordinators, administrators, HR managers and agency credentialing leads. Skilled nursing, assisted living, home health and the agencies that staff them.

Concretely: whoever is currently the human backup system for a folder of expiration dates. If a building would fail a survey the week you took vacation, this was built for you.

Free forever up to 10 employees, with every feature: all 33 requirements, the alerts at 30, 15 and 7 days, the full record history. Not a trial that expires.

Above that it is priced by the size of the building, not per seat: $39 a month for 11 to 25 employees, $69 to 50, $129 to 100, $229 to 200. Adding a second coordinator, a scheduler or your administrator costs nothing, because charging you to give another person visibility into compliance would be a strange thing to do. Annual billing takes about 10% off. Full breakdown on the pricing page.

One sitting. Import the roster, then work down the list entering the dates you already have on file. A 43-person building is typically done in an afternoon, and it is done by the person who already knows the answers rather than by an implementation consultant.

There is nothing to install, no server to stand up, no integration with your EHR and no IT project to get approved. If you can use a spreadsheet, you can use Credolex.

Yes. The live demo is the real application with a sample facility loaded, no sign-up and no email address required. Click into a person, change a date, watch the status change.

One caveat we would rather state plainly: the sandbox is shared by everyone who opens that link and it is wiped and rebuilt every night. Do not put real staff in it. Its sample people use addresses on a domain that cannot receive mail, and the reminder job skips it entirely, so nothing you type there emails anybody.

Credolex is onboarding a small number of facilities at a time, on purpose, so that the first buildings on it get answered the same day when something is wrong. Fill in the request form above and we will email you an access code when your turn comes up.

Telling us your state and roughly how many licensed beds you have is genuinely useful: it is how we decide which state requirement sets to build next.