Security
How we protect your health data
DoseVault is a personal tracking app, not a medical record system. We are not a HIPAA Covered Entity. Even so, we treat dose, vial, and bloodwork data as PHI-grade — the controls below are in place today.
In transit
All traffic to dosevault.ai is HTTPS. HSTS preloads enforce TLS 1.2+ for one year, so a downgrade attack on a logged-in user fails before it reaches us. Service worker resources, API routes, and the marketing site share the same HSTS posture.
At rest
The Postgres database is hosted on Neon with AES-256 encryption applied at the storage layer by default. Sensitive free-text columns (dose log notes, bloodwork annotations, clinic prescriber notes) are additionally encrypted at the application level with AES-256-GCM using a per-record IV before they ever hit the database. Even a leaked backup of those rows reveals only ciphertext until the encryption key is supplied.
Key management
The PHI encryption key is held only in the production runtime environment (Vercel project settings). It is never written to source control, never committed to container images, and never served to the browser. Key rotation is supported — when we rotate, both the old and new key are present long enough to re-encrypt historical rows without a maintenance window.
Authentication
Sign-in is handled by Clerk with email magic-link, OAuth (Google / Apple), and optional MFA. Sessions are bound to short-lived JWTs verified on every request to /api/protected/* and /app/*. Webhook callbacks from Clerk and Stripe are verified cryptographically (svix and Stripe signatures) before any state change.
Access control
Every server action checks the authenticated user's ID and refuses to read or write rows that don't belong to them. The clinic tier adds explicit roles (owner, prescriber, patient) — patients cannot see other patients, prescribers cannot edit clinic settings, and every PHI read in a clinic context writes to the append-only audit log.
Audit log
Clinic-context PHI access is recorded in an append-only audit_log table with actor, target, action type, and timestamp. The log is exposed to clinic operators on the dashboard and retained for at least six years — the standard HIPAA retention window.
Rate limiting & abuse
All AI endpoints (vial scanner, bloodwork PDF parse) are rate-limited per user with a token-bucket. Body sizes are capped (6 MB image, 10 MB PDF). MIME types are whitelisted server-side; nothing else reaches the model provider.
Data minimization
Analytics events for clinic paths exclude Clerk user IDs. Sentry breadcrumbs are stripped of request bodies, cookies, and Clerk identifiers. We never log dose or bloodwork values in error reports.
Your data, on demand
Every account can export their full data set as JSON from Settings and request hard-deletion of all associated rows. The deletion cascades through all child tables; we keep no PHI shadow copies.
Subprocessors
The third parties that may process DoseVault data: Neon (Postgres), Clerk (auth), Stripe (payments — no PHI), Resend (transactional email), Anthropic (AI features), Vercel (hosting + edge), Sentry (error monitoring with PII scrubbed). Each is bound by their standard data-processing terms; for clinic-tier customers we sign individual Business Associate Agreements with the subset that touches PHI.
What we are not (yet)
DoseVault is not HIPAA-certified. We are not SOC 2. We are not HITRUST. The controls above match those frameworks in spirit; the formal attestations land when our clinic tier reaches a scale that justifies them. If your organization requires a signed BAA before piloting the clinic tier, reach out — we'll prioritize it.
Reporting a vulnerability
Email security@dosevault.ai. We respond within two business days. Please do not open public GitHub issues for security reports.
Last reviewed: 2026-05-03. Material changes to this posture will be reflected in the page and announced in the product changelog.