Security

WeConsult Rx is built for healthcare. Security and privacy are not bolted on — they are enforced by the code, the database, and the test suite that gates every release.

Encryption

• At rest: AES-256 on database and file storage. Per-tenant storage prefixes prevent cross-tenant object access.
• In transit: TLS 1.2+ on every endpoint. HSTS enforced on production domains.
• Tenant secrets: Integration credentials stored in an encrypted vault. Secrets are never returned to the client.

Access control

• Multi-factor authentication enforced for staff accounts on the platform.
• Role-based access (owner · admin · reviewer · staff) with tenant-scoped data isolation on every PHI table.
• Cross-tenant access blocked at the database layer — verified by automated isolation testing on every release.
• Administrative credentials are never present in browser bundles.

Audit logging

Every action that touches PHI is logged to an append-only audit trail. Logs include actor, action, resource, and sanitized metadata. PHI is excluded from metadata by automated safety checks.

• Retention: 7 years (HIPAA §164.530(j))
• Export: tenant admins can export their tenant's audit slice via signed link.
• Rate limits on bulk exports to prevent exfiltration.

Application security

• Static type checking on every package in the monorepo.
• Dependency scanning on every pull request.
• Honeypot and rate limiting on every public form.
• Webhook signatures verified for e-signature and notification providers.

Data residency

Primary database and storage in US-based, HIPAA-eligible infrastructure. AI inference runs in HIPAA-eligible regions only, on de-identified prompts.

Vulnerability management

Security researchers — please see our responsible disclosure policy and email [email protected].

Incident response

Security incidents are triaged within one business hour during US business hours. Customers are notified per BAA terms (no later than 60 days for confirmed breaches; sooner for material incidents). Post-incident reports are shared with affected customers.

Penetration testing

Automated security testing runs on every release. Third-party penetration test scheduled annually beginning Q1 2027. Customers under Professional and Enterprise tiers may request a summary letter.