Loading
Security & Trust
Security is built into the architecture, not bolted on. Here are the technical controls the platform is built against - described plainly, without overclaiming.
Sensitive fields are encrypted with authenticated AES-256-GCM, so data at rest is protected per record.
Row-level security enforces tenant boundaries at the database, not just in application code.
Every action is written to an HMAC-chained log designed to make tampering evident.
Granular roles gate every privileged action; least privilege is the default.
State-changing requests are origin-checked and CSRF-guarded; API routes are auth-gated and validated.
Secrets are never exposed to the browser; the PHI processing path is dormant by default behind an explicit gate.
Read the documentation or reach the team - we are happy to walk through the controls.