Security Overview

Version 2026-10 · How ConfirmDoc protects hospitals' and patients' data. Shared with customers and their auditors; a summary, not a guarantee — the Data Processing Agreement sets the commitments.

Separation between customers

• Every record carries its customer's identity, and the application filters every query by it.
• The database enforces it too (PostgreSQL row-level security): each request runs under a restricted database role that can only see the signed-in customer's rows, so even a programming mistake cannot show one hospital another hospital's patients. The platform console shows whether this protection is active.

Signing in

• Passwords: at least 10 characters with upper- and lower-case letters and a number; common passwords, the person's own name or email and the organisation's name are refused; the last 5 passwords can't be reused; in production, passwords found in known data breaches are refused (only 5 characters of a hash leave our servers).
• Passkeys (fingerprint, face, security key) — phishing-proof — and authenticator-app two-factor. Each hospital can require two-factor for chosen roles; the ConfirmDoc team must use two-factor.
• Single sign-on (OpenID Connect) and automatic user provisioning (SCIM) for organisations that use them.
• Accounts lock after repeated failed sign-ins; sign-in endpoints are rate-limited.
• Sessions: short-lived access tokens (15 minutes) and rotating refresh tokens in secure, HTTP-only cookies; reuse of an old token signs out the whole session family. Changing a password signs out every other device. Hospitals can sign out unused computers after a set time.
• People are told by email when their account signs in from a new device.

Access inside a hospital

• Role-based permissions (more than 100 separate permissions), per branch where needed.
• Restricted records (VIPs, HIV, psychiatry and other sensitive cases) need a stated reason to open ("break the glass"); the access lasts 60 minutes and an administrator reviews it.
• Unusual viewing alerts: one person opening many records in an hour, or records opened in quiet hours, is flagged for review.
• Every change and every opening of a patient's record is written to an append-only audit log (the database refuses edits and deletions of it).

ConfirmDoc staff

• Platform roles split the work (support, finance, onboarding, operations); a two-person rule can be required for risky actions (deleting a customer's data, large refunds, big discounts, security settings).
• Support staff can see a customer's data only after the customer's administrator approves, for a limited time, read-only; every screen they open is logged and visible to the customer.
• The platform console can be limited to listed IP addresses.

Data protection

• In transit: HTTPS (TLS 1.2+) everywhere, HSTS, strict security headers and content-security policy.
• At rest: encrypted disks and database storage (cloud provider); sensitive fields (national ID numbers, bank accounts, two-factor secrets, integration keys) are additionally encrypted by the application with AES-256-GCM. Keys can be rotated; old values are re-encrypted automatically.
• Uploads are checked against their real file type and scanned for malware (ClamAV) before they are stored.
• Backups: encrypted nightly (AES-256-GCM with a separate backup key), copied off the server, and each one is checked to be restorable; failures alert the operations team.
• Location: customer data is stored in India.

Privacy (DPDP Act 2023)

• Versioned privacy notices, consent by purpose (treatment, reminders, AI calls, sharing, marketing, research) with withdrawal at any time, and patients' requests (access, correction, erasure, grievance, nominee) tracked against a 30-day target — at the desk and in the patient app.
• A breach and incident register with the reporting deadlines (CERT-In 6 hours, Data Protection Board 72 hours for details).
• Full data export for a customer at any time, and deletion after the retention period when they leave.

Running the service

• Health monitoring every minute (database, queues, documents, backups, error spikes, background jobs) with alerts by app, email, WhatsApp and webhook, and a public status page.
• Server errors are grouped and tracked (optionally in Sentry); request metrics are available to monitoring (Prometheus).
• Maintenance mode keeps every hospital able to view and print while upgrades run.
• Automated dependency, code and secret scanning on every change; a security check script for each release; penetration testing at least once a year.
• A web application firewall (Cloudflare or AWS WAF: OWASP and managed rules, rate limits) in front of the servers for live hospitals, with the servers accepting connections only through it; checked from outside with a script before each test and release.
• Load-tested with 200 people of one hospital working at once (typical page under 0.1 s, no errors); limits are per person, so a hospital whose staff share one internet address is never throttled as a whole.

Reporting a problem

Write to the ConfirmDoc security team at the address in your agreement. We acknowledge within one working day.