Security & Compliance

Last updated: September 4, 2026

This page is a good-faith, standard-form summary provided for beta review. It is not a substitute for advice from qualified legal counsel and is pending formal attorney review before this platform is used with real patients or partners.

An overview of the technical and organizational measures behind this platform, for anyone evaluating it.

Encryption

At rest — patient contact and symptom fields are encrypted (AES-256-GCM) at the application layer before being written to the database. Field-level encryption, not just disk-level.
In transit — all traffic is served over TLS 1.2+.
Keys — the encryption key lives only in server-side configuration, never in source code or the database itself.

Access control

Role-based access: super_admin, admin, and partner, with owner/staff permission tiers within a partner account for billing and team management.
A chiropractor partner can only see leads routed to their own account — enforced at the database query level, not just hidden in the UI.
JWT access tokens expire after 15 minutes; portal sessions are force-logged-out after 15 minutes of inactivity, regardless of token expiry.

Audit logging

Every access to a patient record, every status change, every configuration change, and every failed login is written to an append-only audit log — no update or delete operation is permitted against it at the database level. Retained for a minimum of six years.

Spam & abuse prevention

Every public submission passes through IP blocklist checks, US geofencing, sliding-window rate limiting, reCAPTCHA v3 scoring, a honeypot field, and 24-hour duplicate-submission detection before it's accepted — configurable per deployment, all logged to the audit trail when triggered.

Payment security

Card details are tokenized directly in the browser via Authorize.Net's Accept.js and never transmitted to or stored on our servers — our servers only ever see an opaque, single-use token. This keeps card-data handling out of scope for the heaviest tier of PCI DSS requirements.

Business Associate Agreement

Every chiropractor partner executes a Business Associate Agreement before their embed goes live — no exceptions. See the full BAA.

Infrastructure

The application runs in isolated Docker containers behind a reverse proxy terminating TLS with a Let's Encrypt certificate, auto-renewed. Database and cache layers are not exposed to the public internet.