Security and data
Where your records live
All customer data is stored and processed in the United States. The application region, the database region and the attachment storage region are pinned.
Who can reach them
Each practice's records are isolated in the database itself, not only in application code. Every table carries the practice it belongs to, and the database refuses reads and writes that cross that line — so a mistake in our code fails closed rather than leaking. We test this on every commit.
How we know nothing was altered
Records are append-only. Correcting an entry adds a new one and keeps the original, with the reason. Every change is written to a log chained by SHA-256, and a job walks those chains weekly. That makes silent alteration detectable — including by us. Every export carries the verification result.
Backups
Point-in-time recovery on the database and versioning on attachment storage. We restore a backup to a scratch environment every quarter and check it, because a backup nobody has restored is a hope, not a backup.
Taking your records with you
Export everything at any time, free — a PDF for people and a JSON and CSV bundle for machines, with your photo attachments. If you cancel, your account becomes read-only and stays fully exportable for 90 days, and we email you before anything is deleted.
Sub-processors
| Service | What it does | Region |
|---|---|---|
| Vercel | Application hosting | United States (iad1) |
| Neon | Database | United States (us-east) |
| Cloudflare | CDN, DNS, and R2 object storage for attachments | United States |
| Stripe | Payments | United States |
| Resend | Transactional email | United States |
| Sentry | Error reporting | United States |
| PostHog | Product analytics | United States |
Sign-in is handled by our own software on our own database. No third-party identity provider holds your staff accounts.
What we do not hold
No patient names, no patient identifiers, and no link from an instrument to a patient. Traceability stops at the load number. That is a deliberate limit, and it keeps this product outside the scope of health-information regulation.