We treat security as a first principle, not a checkbox. Every architectural decision — from how we store a prescription to how an engineer accesses a server — is made with patient privacy at the centre.
Certifications & Standards
Not bolted on after the fact. Security is a foundational constraint in every product decision we make.
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Your patient records are unreadable to anyone without authorisation — including us.
Our entire stack — cloud hosting, databases, file storage, and third-party integrations — operates under signed BAAs and HIPAA-aligned controls.
Every internal system interaction is authenticated and authorised independently. No implicit trust. Least-privilege access by default across every service.
Each clinic's data lives in a fully isolated environment. Row-level security at the database layer ensures one tenant can never access another's records.
Encrypted point-in-time backups run every hour. Data is replicated across multiple availability zones. Recovery time objective: under 1 hour.
Anomaly detection, intrusion prevention, and real-time alerting run 24/7. Suspicious access patterns trigger automatic session termination and team alerts.
No single control stands alone. A breach at one layer cannot compromise the whole.
Data encrypted at rest & in transit
Recovery time objective
Threat monitoring & alerting
PHI breaches since launch
Found a vulnerability? We take security reports seriously. Contact us privately and we commit to acknowledging your report within 24 hours, keeping you informed, and crediting you if you wish.
security@docsuite.appOnly the staff members you explicitly invite to your clinic workspace. DocSuite engineers cannot access your patient records — our architecture prevents it. Access to production databases requires multi-party approval and leaves a permanent audit trail.
Data is stored in SOC 2 certified cloud infrastructure within the US by default. Enterprise customers can request EU or APAC regional hosting. All data is replicated across at least two availability zones.
We will notify affected customers within 72 hours of confirmed breach discovery, in compliance with HIPAA Breach Notification Rule. We maintain a detailed incident response plan that is tested and updated quarterly.
Never. Patient data is never sold, never used for advertising, and never shared with third parties except sub-processors that are strictly necessary to operate the service — all of whom have signed BAAs.
Yes. Enterprise and Professional customers can request our most recent third-party pen test executive summary under NDA. Contact security@docsuite.app.
Our security team responds to all enquiries within one business day.