Security

Data in transit

All traffic between your browser and Healthesis.AI is encrypted with TLS (HTTPS). Browsers are instructed to use HTTPS only (HSTS), and a strict content security policy limits what the application pages can load.

Accounts and sign-in

• Passwords are hashed with scrypt, a deliberately slow, memory-hard algorithm, with a unique salt per password. We never store or see your password in plain text.
• Sessions use opaque random tokens held in an HTTP-only cookie. Only a keyed hash of each token is stored on our servers, and sessions can be revoked server-side.
• Email addresses are verified before an account can subscribe.
• Sign-in and other sensitive actions are rate limited to slow down password guessing and abuse.

Separation between customers

Every workspace's data is isolated at the database level with Postgres row-level security, in addition to checks in the application. A request made on behalf of one workspace cannot read another workspace's companies, documents or reports.

Documents and storage

• Uploaded files are kept in private storage and are served only to signed-in members of the workspace they belong to.
• Deleting your account permanently deletes its workspaces, documents and reports. You can also ask us to delete specific documents. Deleted data disappears from backups as they rotate, within 14 days.
• Database backups are taken daily.

AI processing

To generate analyses, document content is sent to OpenAI's API. Under OpenAI's API terms, data sent through the API is not used to train their models; OpenAI may retain it for a limited period for abuse monitoring. Document text is treated as untrusted input, and the analysis is instructed to ignore any instructions embedded in uploaded documents. See the Privacy Policy for the full list of service providers.

Payments

Payments are handled by Stripe. Card details are entered on Stripe's pages and never reach our servers; we never see your full card number.

Operations

• Changes to workspace data, such as creating, updating, archiving or deleting companies, are recorded in an audit log.
• Access to production systems is limited to what is needed to run the service (least privilege).
• Service credentials are kept out of source code and stored as protected configuration.

What we ask of you

• Use a strong, unique password and keep it private.
• Do not upload patient-identifiable health data or other personal data that the analysis does not need.
• Tell us promptly if you suspect someone else has accessed your account.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email support@healthesis.ai with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, do not access or modify other customers' data, and avoid degrading the service. Our contact details are also published at /.well-known/security.txt.