Security and compliance

Built as a HIPAA system from the first line

Patient information is the most sensitive thing a laboratory holds. These are the controls, stated plainly, so your compliance officer can check them against your own requirements.

Encryption: TLS on every connection. Encrypted storage at rest, and a second layer of field-level encryption on the most sensitive values (authenticator secrets, patient contact details, integration credentials, message bodies). Recovery codes and session tokens are stored only as one-way hashes.
Tenant isolation: Every record belongs to one laboratory. Row-level security in the database and an authorization check on every request both have to agree before a row is returned. An empty scope returns nothing.
Identity: Passwords checked against breach lists, no forced composition rules. A mandatory authenticator code for every staff account, with recovery codes; each code works once, and wrong codes are limited per account, not per sign-in. Account and network lockouts. Sessions idle out and expire absolutely.
Minimum necessary: Patient identifiers stay hidden until a reader chooses to reveal them, and the reveal is recorded. Dashboards are aggregate only. Patient information never appears in a URL, an e-mail, a chat message or a log line.
Audit: Every sign-in, view, download, export and administrative change is written to a hash-chained, append-only log, exported nightly to write-once storage, and readable by your own administrators.
Review before release: A report cannot be retrieved by anyone, person or system, until it has cleared review. Clearance must be positive: a missing check holds a report just as a failed one does.
Integrity: Every stored report carries a checksum that is verified on download. A mismatch blocks the download and raises an alert.
Backups: Encrypted before they leave the server, kept in versioned storage, and restored on a schedule to prove they can be.
Patient access: Patients activate with a code issued by their laboratory, their name and date of birth, a one-time code sent to an e-mail address they confirm as their own, and an authenticator. Name and date of birth alone never open a record.
This website: Serves no third-party scripts, fonts or trackers. Its forms send business contact details to us and nothing else. Server logs keep each request's network address for 30 days, for abuse prevention, then delete it.

Business Associate Agreement

We sign a BAA with your laboratory before any of its patient information reaches us.

Request a BAA

Clinical content

Every decision rule traces to an authoritative U.S. source. No AI model runs when a report is generated. Reports are decision support for licensed clinicians.

Read the FAQ

Report a vulnerability

Found something? Tell us privately through the contact form and we will respond within one business day.