Security
Designed with privacy and security controls appropriate for sensitive healthcare information.
Trust is the product. These are the controls we build around, described plainly and without claims we cannot support.
Access control
- Every account has a defined role, and permissions follow that role.
- Authorization is enforced on the server and in the database — not by hiding buttons.
- One facility cannot reach another facility's data.
- One worker cannot reach another worker's documents.
- One referral partner cannot reach another partner's referrals.
- Access follows least privilege by default.
Documents and records
- Documents are held in private storage and are never publicly linked.
- Uploads are validated for file type and size.
- Uploads, downloads and deletions are recorded.
- Audit history is append-oriented and cannot be edited by ordinary users.
Handling sensitive information
- Health information is kept out of URLs and query strings.
- Health information is kept out of marketing analytics and advertising pixels.
- Notification previews avoid sensitive detail.
- Error messages shown to users never expose internal system detail.
Accountability
- Sign-in, record changes, verifications and permission changes are logged.
- Credential verification records who verified, how, and when.
- Care placement records what options were presented and what was chosen.
- Every significant workflow transition is timestamped.
What we will not claim
We do not describe ourselves as certified or compliant with any framework unless the underlying infrastructure, contracts, policies, configurations and operational controls have actually been reviewed and verified. We would rather tell you what we do than borrow a label.
This platform provides operational and administrative technology. It does not independently determine medical necessity, clinical suitability, scope of practice, licensing status, or legal eligibility.
If you believe you've found a security issue, contact us and describe the problem without including anyone's personal or health information.