Loading
Security & Trust
Security is built into the architecture, not bolted on. Here are the technical controls the platform is built against - described plainly, without overclaiming.
Sensitive fields are encrypted with authenticated AES-256-GCM, so data at rest is protected per record.
Row-level security enforces tenant boundaries at the database, not just in application code.
Every action is written to an HMAC-chained log designed to make tampering evident.
Granular roles gate every privileged action; least privilege is the default.
State-changing requests are origin-checked and CSRF-guarded; API routes are auth-gated and validated.
Secrets are never exposed to the browser. The code path that could process PHI is switched off and cannot be turned on from the browser.
Read the documentation or reach the team - we are happy to walk through the controls.