Security
How we protect provider accounts, practice data, and pet owner information.
Authentication and sessions
- Passwords never stored in plain text; bcrypt-hashed
- JWT-based session tokens with short expiry
- HTTPS everywhere; HSTS enforced
- Rate limiting and account enumeration protection on login
- Bot protection on signup forms
Access control
- Role-based access: owner, manager, staff, admin
- All API queries authorized server-side; never trust client-provided org ID
- Cross-tenant isolation: staff can only access their organization
- Pet health data gated by active consent grants, checked live
- Internal admin routes inaccessible without platform_admin role
Audit and monitoring
- Immutable audit log for consent grants, data access, and admin actions
- Access events logged: actor, organization, resource, outcome, timestamp
- No sensitive content written to logs or analytics events
- Verification evidence stored in restricted, access-logged storage
Infrastructure
- Hosted on Vercel (frontend) and Supabase (database), both SOC 2 compliant
- Secrets managed via environment variables; never committed to source
- Uploaded files stored in Supabase Storage with per-file access control
- Image uploads validated by MIME type, not filename extension
- No hard-coded API keys or tokens in client-side code
Responsible disclosure
If you discover a security vulnerability in PetMyDear, please report it responsibly to security@petmydear.com. Please do not publicly disclose vulnerabilities before we have had a chance to investigate and address them. We aim to acknowledge security reports within 48 hours and provide a timeline for resolution.
We do not claim HIPAA certification. We encourage providers who handle protected health information to conduct their own legal review before using PetMyDear for clinical data exchange.