Security is not a feature we added — it is built into every layer of the AVD Clinical platform. This page explains exactly what protections are in place, what their limits are, and how to contact us if you find a vulnerability.
Security Controls at a Glance
🔒 Encryption in Transit
All connections use TLS 1.2 or higher. HTTP requests are redirected to HTTPS. Enforced via Cloudflare.
🔐 Encryption at Rest
All database content — including medicine reminder data — is encrypted at rest using AES-256 via Supabase's storage layer.
🔑 Passwordless Auth
No passwords are stored. Authentication uses one-time codes (OTP) sent by email or SMS. Codes expire in 10 minutes and are single-use.
🛡 Row-Level Security
Every database table has Row-Level Security (RLS) policies. Application-level access is restricted by row-level security, so your data is only accessible when you are authenticated as the account owner. Administrative access, if ever required for support or security operations, is limited, controlled, and used only according to internal policies.
💳 No Card Data
AVD Clinical never sees, stores, or processes payment card numbers. All payments are handled by Stripe's PCI DSS Level 1 certified infrastructure.
🌐 DDoS & Edge Protection
The site is served via Cloudflare Pages with automatic DDoS mitigation, WAF protection, and global CDN edge caching.
1. Authentication
AVD Clinical uses OTP-based (one-time password) authentication — there are no stored passwords on our system. When you sign in:
- You enter your email address (or phone number).
- A 6-digit code is sent to that address via email (Resend) or SMS (Twilio).
- The code is valid for 10 minutes and invalidated after first use.
- A session token is stored in your browser as an encrypted cookie. The token has a rolling expiry — inactive sessions are expired automatically.
This approach eliminates the risk of password reuse, credential stuffing, and brute-force attacks against stored passwords.
2. Data Storage & Access Control
All user data is stored in Supabase (PostgreSQL), hosted on AWS in the US East region. The following controls are enforced:
- Row-Level Security (RLS): Applied to every table. Queries issued without a valid session token return empty results, not errors — preventing enumeration attacks.
- No direct database access: AVD Clinical uses Supabase's API layer exclusively. No direct SQL connections from the frontend.
- Supabase publishable key only: The key embedded in the client-side code is Supabase's "anon/publishable" key — it has no elevated privileges and is subject to RLS policies. The service role key is never exposed in the frontend.
- Encrypted at rest: AES-256 encryption applied at the storage level by Supabase/AWS.
3. Sensitive Data Categories
Medicine Reminder Data
Medicine reminder data (medication names, doses, prescribing doctor, pharmacy, refill dates) is treated as health-sensitive. It is encrypted at rest, access-controlled by RLS, and never shared with third parties for any commercial or analytical purpose. Only you can read your own reminder records when authenticated.
Payment Data
AVD Clinical does not store card numbers, CVV codes, expiration dates, or full bank account details. Stripe processes all payments and provides AVD Clinical only with transaction metadata (product, amount, masked card descriptor). Stripe is PCI DSS Level 1 certified.
OTP Codes
OTP codes are hashed before storage and are not accessible in plaintext by AVD Clinical staff. Codes expire after 10 minutes regardless of use.
4. Infrastructure & Hosting
- Hosting: Cloudflare Pages (global CDN, automatic HTTPS, DDoS protection)
- Database: Supabase (PostgreSQL on AWS, SOC 2 Type II certified)
- Email delivery: Resend (transactional email API)
- SMS delivery: Twilio (verified toll-free number)
- Payments: Stripe (PCI DSS Level 1)
Supabase's infrastructure certifications (SOC 2 Type II, ISO 27001) cover the database and authentication layer. Cloudflare's infrastructure covers the hosting and network layer.
5. What We Have Not Implemented (and Why It Matters)
AVD Clinical has not implemented HIPAA-specific technical, administrative, or physical safeguards as required by 45 CFR Part 164. This includes: dedicated HIPAA audit logging, workforce security training programs, formal risk assessments, physical facility controls, and executed Business Associate Agreements.
This means: do not enter Protected Health Information (PHI) of patients or research subjects into any part of the current Service. See our HIPAA Notice for details.
6. Incident Response
In the event of a security incident affecting user data, we will:
- Contain the incident and assess scope within 24 hours of detection.
- Notify affected users by email within 72 hours if personal data was exposed.
- Provide details of what data was affected, what we have done, and what you should do.
- Cooperate with applicable regulatory authorities as required.
7. User Security Responsibilities
Security is a shared responsibility. To protect your account:
- Protect your email account. Because we use email OTP, your email account is your key to AVD Clinical. Use a strong password and enable two-factor authentication on your email.
- Do not share OTP codes. AVD Clinical will never ask for your OTP code by phone, email, or chat. Sharing it gives someone full access to your account.
- Sign out on shared devices. Session tokens persist in the browser — sign out on any device you share with others.
- Report suspicious activity. If you believe your account has been accessed without your permission, contact us immediately.
🔍 Responsible Disclosure
If you discover a security vulnerability in AVD Clinical, we ask you to report it responsibly. Please:
- Email info@avdclinical.com with subject "Security Vulnerability Report"
- Describe the vulnerability, steps to reproduce, and potential impact
- Do not publicly disclose the vulnerability until we have had reasonable time (30 days) to investigate and remediate
- Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability
We will acknowledge your report within 2 business days. We do not currently offer a bug bounty program, but we will credit researchers who report valid vulnerabilities responsibly.
8. Related Trust Pages
- Data Flow Diagram — what data moves where and through which vendors
- Vendors & Subprocessors — every third party with certifications
- Electronic Records Readiness — honest current-state assessment
- HIPAA & PHI Notice
- Privacy Policy
9. Contact
Security questions, incident reports, or vulnerability disclosures:
AVD Clinical
Email: info@avdclinical.com
Phone: +1 929-502-4973