Security Controls & Architecture

In-Transit Encryption

All communications use TLS 1.2+ with strong cipher suites. HSTS headers enforce HTTPS-only connections.

At-Rest Encryption

All database records, backups, and stored files are encrypted using AES-256. Encryption keys are managed through a secure key management service.

Application-Level Encryption

Sensitive fields like voice transcripts and assessment answers are stored in encrypted database columns with access-controlled decryption.

Secure Authentication

Email-based authentication with password hashing (bcrypt). Sessions are managed via secure, HttpOnly tokens with automatic refresh and expiration.

Role-Based Access Control (RBAC)

Three distinct roles — Patient, Clinician, and HR Admin — each with granular permissions enforced at the database level via Row-Level Security (RLS) policies.

Principle of Least Privilege

Users can only access their own data. Clinicians see only assigned patients. Admins have organizational scope. No role can escalate privileges.

Security Definer Functions

Role checks use PostgreSQL security definer functions to prevent RLS recursion and ensure tamper-proof authorization logic.

Managed Cloud Infrastructure

Hosted on enterprise-grade cloud infrastructure with automatic patching, DDoS protection, and 99.9% uptime SLA.

Network Isolation

Database servers are not directly accessible from the public internet. All access goes through authenticated API endpoints.

Automated Backups

Daily automated database backups with point-in-time recovery capability. Backups are encrypted and stored in geographically separate locations.

Edge Functions

Server-side logic runs in isolated, sandboxed edge functions with limited permissions and no persistent state.

Per-User Data Isolation

Every table containing user data has RLS policies ensuring users can only read, create, update, or delete their own records.

Clinician Access Policies

Clinicians can view (but not modify) patient assessments, mood entries, and crisis alerts — enforced at the database level.

Admin Scope Restriction

HR Admins can view profiles and manage content (blogs, chants, helplines) but cannot access individual patient health data without explicit policy grants.

Public Data Policies

Only explicitly public resources (published blog posts, chants, helplines) have open SELECT policies. All other data defaults to deny.

Explicit Consent Records

Every assessment and voice recording requires explicit user consent. Consent records store timestamp, consent text, type, and IP address.

Immutable Audit Logs

Consent records and assessment data use INSERT-only policies — once created, they cannot be modified or deleted by the user, ensuring data integrity.

Crisis Alert Logging

High-severity assessment scores automatically trigger crisis alerts with full audit trail — who triggered it, when, and resolution status.

Automated Crisis Detection

Assessment scoring automatically flags high-severity results (e.g., suicidal ideation indicators on PHQ-9 Q9) and creates crisis alerts for clinicians.

Clinician Notification

Crisis alerts are immediately visible to clinicians with resolution tracking — who resolved it and when.

Helpline Integration

Database-driven helpline directory ensures users always have access to current, verified crisis support numbers (Kiran, iCall, Vandrevala).

Schema Validation

All user inputs are validated using Zod schemas on the client side with type-safe constraints (length limits, format checks, required fields).

Parameterized Queries

All database interactions use parameterized queries through the ORM — eliminating SQL injection vectors.

Content Security

User-generated content is never rendered as raw HTML. All outputs are properly escaped to prevent XSS attacks.

Authenticated API Calls

Every API request carries an authentication token verified server-side. Anonymous access is limited to public read-only resources.

Rate Limiting

API endpoints are protected against abuse with rate limiting and request throttling at the infrastructure level.

CORS Configuration

Cross-Origin Resource Sharing is restricted to authorized domains only, preventing unauthorized third-party access.

Security Linting

Automated database security linters check for missing RLS policies, overly permissive rules, and configuration drift.

Dependency Scanning

Third-party dependencies are regularly audited for known vulnerabilities.

Penetration Testing

Periodic security assessments and penetration testing are conducted to identify and remediate vulnerabilities.