What a hospital security reviewer needs to know, stated the way we would want to read it: what we do, what we do not do yet, and where we stand.
Written to be forwarded to IT. Every line below describes something the service does today.
| Area | What we do |
|---|---|
| Data handled | Purchase-order and item-master lines, the recall alerts matched to them, and the compliance record your team keeps on each alert. Uploading PHI, Social Security numbers, or payment data is prohibited by the Terms. |
| In transit | TLS on every connection; plain HTTP redirects to HTTPS; HTTP Strict Transport Security enabled for one year across subdomains. |
| At rest | Uploaded files, generated reports, and forwarded notices are stored in Cloudflare R2, which encrypts objects at rest. The database runs on Railway-managed PostgreSQL in the United States. |
| Sign-in | Auth0 handles authentication; RecCheckMD never sees passwords. Identities that Auth0 reports as unverified are refused. Single sign-on and multi-factor authentication through Auth0 can be enabled for your organization on request. |
| Tenant isolation | Every record is scoped to your organization. Cross-organization access is denied in code and verified by automated tests that run before every deployment; a removed or disabled user’s session stops working immediately. |
| Roles | Organization admins manage members, invitations, and settings; members work alerts. Joining an organization is the invitee’s explicit act. |
| Browser protections | Session cookies are HttpOnly, Secure, and SameSite; requests that change data carry a CSRF token; a Content Security Policy, frame-ancestors none, nosniff, and a strict referrer policy are set on every response. |
| Downloads | Files are served through signed links that expire after ten minutes. |
| Backups | Nightly database backups to a separate storage bucket the application cannot write to; about thirty daily backups plus monthly copies are retained. Restores are rehearsed weekly by an automated drill that restores into a clean database and checks every table’s row count; the most recent rehearsal restored the full database in under a minute. |
| Audit trail | Every change to a compliance record is attributed to a user and timestamped; assistant tool calls and user activity are logged. |
| Retention | Your data is kept for the life of your subscription, available for export for thirty days after it ends, then deleted apart from routine backups. |
| Dependencies | Pinned versions with automated advisory scanning; the deployment pipeline runs the security regression suite before a release goes live. |
| Subprocessors | Auth0 (sign-in), Railway (hosting and database), Cloudflare R2 (file storage), Resend (email), Anthropic (AI assistant and notice reading), U.S. FDA openFDA (public recall data), DuckDuckGo (product images), Google Fonts and jsDelivr (browser assets). Details in the Privacy Policy. |
| Incident notification | Confirmed unauthorized access to your data is reported to your organization without undue delay and within seventy-two hours. |
We are not SOC 2 certified. Our controls are documented and mapped, and we will begin a formal audit when a customer’s procurement requires it. We would rather say that here than have you find it in diligence.
An internal security review covering authorization, tenant isolation, injection, network surfaces, and session handling was completed in September 2026 and its findings were fixed. We have not yet commissioned a third-party penetration test. Ask for our security questionnaire responses and we will send them the same day.
If you believe you have found a security issue, email info@reccheckmd.com with enough detail to reproduce it. We will acknowledge within two business days and keep you informed. Please do not run vulnerability or load testing against the service without written consent (see the Terms); we are glad to arrange it.