Encryption
HTTPS everywhere; sensitive data encrypted in transit and at rest. Secrets managed per environment, never in code.
Trust
Security, Stated Plainly.
How we protect business and customer data — and what we explicitly do not claim.
Tenant isolation
Every business’s data is strictly scoped — users can only ever see their own business, enforced server-side.
Least privilege
Owner, manager and staff roles with granular permissions; sensitive admin actions require reason and audit log.
Audit logging
Logins, permission changes, data exports and business-critical edits are recorded with who, what and when.
Sensitive information
Health-related details are treated as sensitive by default: minimized in notifications, logs and analytics. AI handles admin work only — never diagnosis or treatment decisions.
No empty badges
We claim no HIPAA, GDPR, SOC 2 or ISO certifications on this page unless listed here with evidence. Status: [none claimed].
Report a security issue
Found a vulnerability? Tell us through the contact page with what you found, where, and how to reproduce it. Include your contact details if you want credit and updates. We acknowledge reports promptly, fix verified issues as a priority, and will never take legal action against good-faith researchers. Please avoid accessing other customers' data, degrading service, or phishing our users while investigating.