The one-page version — written to be checked, not taken on faith.
Verified against the source code and live database as of the date below. For subprocessors and the full controls list, see the full security page.
What it does
Daily compliance logging for clinics. Staff record shift checks — refrigerator temperatures, crash cart, oxygen, narcotics counts — and track staff credential dates. Surveyors get a clean, read-only export.
What data it holds
No patient records, no billing data — no patient table exists in the schema.
| Surface | What's stored |
|---|---|
| Staff accounts | Name, work email, job title, role, optional photo. No SSN, no DOB, no home address. |
| Compliance logs | The reading, who filed it, when, and from where. |
| Credentials | License type, issuer, and expiry date. |
| Surveyor view | Logs and credential dates, via a time-limited link. |
Record integrity
- Insert-only, by database trigger — not a UI restriction. A correction adds a new row; nothing is edited.
- Hash-chained — an outside edit would break the chain visibly.
- Network-stamped on every entry. GPS geofencing is a separate, per-clinic opt-in.
- An out-of-range value requires a written corrective action to save.
Access control
- No self-signup — administrator-invited only.
- Google sign-in, or an emailed code that expires in 10 minutes, 5-attempt lock.
- Mandatory TOTP for admins, owners, and clinical leads — no setting turns it off.
- Step-up re-authentication on narcotics counts, credential sign-off, discipline, and e-signatures.
- Fixed, database-enforced roles — not something application code can invent.
- Row-level security on every table, enforced by Postgres, not application code.
- Surveyor links are time-limited and revocable, stored only as a hash.
Hosting and infrastructure
- Hosting: Vercel — edge network, serverless.
- Database: Supabase Postgres, encrypted at rest.
- In transit: TLS everywhere, no plaintext origin.
- Files: private bucket, short-lived signed links only.
- Payments: Stripe — card data never reaches our servers.
Where we stand on certifications
Not audited
SOC 2
No report, Type I or II. On the roadmap, no date yet.
Out of scope
HIPAA
Not a Business Associate, no BAA — no PHI is processed.
If that changes: a patient-identifying feature means a signed BAA before it ships, not after.
Want the full detail?
Subprocessors and the complete controls list live on the full security page. Have a questionnaire instead? Send it.
Send it to us