The encrypted inbox and vault

Each clinic has a key pair made in the owner's browser when the vault is created:

• The public key is published on your intake page. A patient's phone uses it to lock the brief's key, after encrypting the brief itself with AES-256-GCM.
• The private key is wrapped with your vault passphrase (PBKDF2-SHA-256, 600,000 rounds, AES-256-GCM) before it's stored. Only the wrapped form reaches our servers.

To read briefs, a team member unlocks the vault in their browser tab with the passphrase. The passphrase never leaves the browser; we log that the vault was unlocked, and every brief opened.

• Changing the passphrase (Settings) re-wraps the same key, so existing briefs stay readable.
• If the passphrase is lost, nobody, including ReadySeen, can open briefs that were sent to the old key.
• Briefs are erased from ReadySeen when they expire (24 hours to 7 days, chosen by the patient) or when the patient withdraws them. Copy what you need into your own record.