Security
Security you can inspect, not just take our word for.
Every control on this page reflects what's actually implemented today — not a roadmap item and not marketing language. See Compliance for what certification and compliance status honestly looks like right now.
Authentication
JWT access tokens with rotating, hashed, revocable refresh tokens. Passwords are hashed with bcrypt (12 rounds) and never logged or returned by any API response.
Role-Based Access Control
Permissions are computed fresh on every request from a 27-resource permission catalog. Six default roles cover most teams; administrators can build fully custom roles. Coding, QA, and billing responsibilities are separated by design — a coder cannot approve their own QA review.
Multi-Tenant Isolation
Every query is scoped to your organization at the application layer. An optional, database-enforced Row-Level Security policy provides a second, independent layer of tenant isolation for defense in depth.
Tamper-Evident Audit Logging
Every write to the platform is recorded in a hash-chained audit log — each entry cryptographically links to the one before it. A dedicated, Owner-only action verifies the full chain hasn't been altered.
Data Protection in Transit
All traffic is designed to run over TLS. Security headers (including a strict Content Security Policy), response compression, and a global exception handler that never leaks stack traces or driver errors to a client are applied platform-wide.
Rate Limiting & Request Validation
Authentication-adjacent endpoints are rate-limited beyond the platform's global default. Every request body is validated against a strict schema — unexpected fields are rejected, not silently dropped.
Upload Validation
Every file upload endpoint (clinical documents, claim/denial attachments, client documents, remittance files) enforces a server-side size cap and file-type allow-list before anything is written to disk.
Correlation & Observability
Every request carries a correlation ID, propagated into structured logs and, where relevant, the audit trail — so any incident can be traced end to end.
What we won't claim
- We do not claim a HIPAA, SOC 2, or HITRUST certification — see Compliance for the honest breakdown.
- We do not claim a live intrusion-detection or 24/7 security operations center.
- We do not claim third-party penetration-test results that haven't been obtained.
If a security question during your evaluation isn't answered here, ask us directly during a demo — we'd rather tell you plainly than leave it ambiguous.
Have a security questionnaire?
Send it to us directly and we'll respond with specifics, not boilerplate.