Security
Built so we can’t read your health information.
Controls
What protects you today.
Every brief is encrypted on the sender’s device with AES-256-GCM. Share-link keys live only in the link fragment; clinic briefs are locked to the clinic’s own P-256 key. Our servers hold ciphertext only.
Spots, photos and answers are stored in the browser on your device and never uploaded unless you share.
Clinic private keys are created in the owner’s browser and stored only wrapped with the vault passphrase (PBKDF2-SHA-256, 600,000 rounds). We can’t unlock them.
Clinics are checked against CMS NPPES, the HHS-OIG exclusion list, SAM.gov and the state licensing board before they can receive briefs, and re-checked monthly.
Passwords hashed with scrypt; common passwords refused; lockout after repeated failures; TOTP two-factor sign-in, required for every clinic and staff account; recovery codes stored hashed.
Random tokens stored only as hashes, in HttpOnly, Secure, SameSite cookies; 12-hour sessions for clinic and admin roles; see and end every session from your account.
Owner, admin and staff roles; every sign-in, vault unlock, brief open and team change is logged and visible to the clinic. ReadySeen staff can’t see brief contents.
No analytics cookies, ad pixels, session recorders or third-party scripts. A strict Content-Security-Policy blocks anything not served by us.
TLS everywhere with HSTS; certificates from Let’s Encrypt; HTTP security headers (no framing, no sniffing, no referrer).
Card details go to Stripe’s hosted pages, never to our servers (PCI DSS SAQ A). Webhooks are signature-checked and replay-safe.
View logs record time and device type, never IP addresses. Brief ciphertext is erased at expiry.
Few dependencies, no known vulnerabilities in production packages at release, and every change tested before deploy.
Compliance
Where we are, honestly.
- End-to-end encryption, verified clinics, two-factor sign-inDone
- HIPAA risk analysis and written security policiesIn progress
- Business associate agreement reviewed by counselIn progress
- Encrypted off-site backups with restore drillsIn progress
- Independent penetration testPlanned
- SOC 2 Type IPlanned
Your own use of ReadySeen is a consumer service. When a clinic subscribes to receive briefs, ReadySeen acts as its business associate under a signed agreement, and the HIPAA Security Rule applies to those briefs.
We have not yet completed a third-party audit or certification; we won’t claim one until we have the report.
Report a vulnerability
Found something? Tell us.
Use the contact form with the topic “Security report”, with enough detail to reproduce it. We acknowledge reports within 2 business days and keep you updated until it’s fixed.
Please test only against your own accounts, never access other people’s data, avoid service disruption, and give us reasonable time to fix before disclosure. We won’t take legal action against good-faith research that follows these rules. Machine-readable contact: security.txt.