Security

We take protecting your account and the information you record seriously. Here's a plain-language look at how.

Authentication

• Passwords are hashed with Argon2id, the current OWASP-recommended standard — we never store or can see your actual password.
• Sessions use a signed, HTTP-only cookie, marked secure in production, so it isn't readable by JavaScript or sent over an insecure connection. Changing your password invalidates any other active session.
• Password resets and email verification both use a single-use, expiring, hashed token sent only to the email on file.
• Repeated failed login attempts on an account are automatically rate-limited.

Authorization

Every page and API request checks who's asking and what they're allowed to see before returning anything — server-side, on every request, not just hidden in the interface. Caregiver access is permission-scoped: an invited caregiver only sees what their specific permission level allows. Administrative access to the platform's operations console is a completely separate role from the customer account system, and is never granted by default.

Data isolation

Your health-organization data is scoped to your account. Every database query that reads or writes it is checked against the account and profiles you actually have access to.

Payments

We never handle or store your card number. Payment is processed entirely by Stripe, a PCI-compliant payment processor.

Infrastructure

Data is stored in a managed PostgreSQL database. Webhooks from our payment processor are verified by cryptographic signature before being trusted. Application secrets (API keys, signing secrets) are kept in environment configuration, never in application code or the browser. The app sends a restrictive Content-Security-Policy and standard security headers on every response, and uploaded files are checked against their actual content — not just the filename or declared type — before being stored.

Reporting a security issue

If you believe you've found a security vulnerability, please tell us through our Contact page (choose "Technical issue") rather than a public forum, so we can investigate before it's disclosed publicly. We'll acknowledge reports and work to address confirmed issues promptly.

An honest limit

No system is perfectly secure, and we can't promise a specific certification we haven't independently obtained and verified. See our HIPAA & Health Data page for exactly where we stand on that specific question.