Security & Privacy
Your records, encrypted, portable, and never used to train AI.
We wrote this page the way we’d want a security team to write it about a product our family uses: plainly, specifically, and without glossing over the gaps.
At a glance
The four promises behind everything else.
Encrypted at rest
AES-256 via AWS KMS.
TLS 1.2+ in transit
HSTS preloaded.
Not used for training
No data flows to provider fine-tuning.
Portable on demand
ZIP export, 7-day account-deletion SLA.
Storage
How your data is stored.
Database
PostgreSQL 16 on an EBS volume encrypted by AWS KMS (default or customer-managed key).
Files
Your original PDFs and images live on the same encrypted volume today, and are moving to S3 + KMS with bucket policy denying unencrypted writes.
Backups
Nightly pg_dump encrypted with GPG before ever leaving the host, shipped to S3 with SSE-KMS, lifecycled to Glacier Deep Archive after 30 days.
Credentials
Passwords hashed with bcrypt (cost factor 12), refresh tokens stored as SHA-256 of the raw token — the raw token never touches disk.
Access
Who can see what.
You (account owner)
Can see: Everything in your account.
Cannot see: Other users.
Family members (coming soon)
Can see: Only records explicitly shared into your circle.
Cannot see: Private records, audit logs they weren't party to.
External share link
Can see: Exactly one document, time-limited, optional passcode, optional download.
Cannot see: Your library, your chats, your account.
Medical Records Vault staff
Can see: Aggregated metrics, error traces with PII scrubbed.
Cannot see: The contents of your documents. We do not read your records. We can restore from a backup on a support ticket, but that is logged and rate-limited.
Authentication
Authentication & session security.
JWT access tokens with a 15-minute TTL, in an httpOnly, Secure, SameSite=Lax cookie.
Refresh tokens with a 30-day TTL, rotated on every use, with reuse detection — if a revoked refresh token is ever presented we revoke the entire family and force re-login.
Bcrypt password hashing at cost factor 12.
Rate limits on every sensitive endpoint (registration, login, password reset, upload, chat).
| Access token TTL | 15 minutes |
|---|---|
| Access token transport | httpOnly, Secure, SameSite=Lax cookie |
| Refresh token TTL | 30 days, rotated on every use |
| Refresh reuse detection | Revoke entire family + force re-login |
| Password hashing | Bcrypt, cost factor 12 |
| Rate limiting | Registration, login, password reset, upload, chat |
Compliance stance
Our honest HIPAA / GDPR / DPDP position.
Medical Records Vault is an educational tool, not a medical device. We do not provide clinical advice or make treatment decisions. Every analysis ends with “ask your doctor” and the product refuses requests to change medications or doses.
We are aligned with the EU GDPR and the India Digital Personal Data Protection Act (DPDP). That means: you can access, export, and delete your data; we log the processing purposes; we don’t sell your data; and we surface breach notifications.
Honest limitation
We are NOT HIPAA-compliant today. We do not yet have a signed Business Associate Agreement (BAA) with OpenAI or Anthropic. If you are a US patient subject to HIPAA and your records contain PHI you cannot risk sharing with those providers, please wait until we announce HIPAA coverage. We would rather lose your signup than mislead you.
Data lifecycle
From upload to gone.
- Step 1
Upload
Files encrypted on write.
- Step 2
Live in your account
Access checked on every read. Every access logged.
- Step 3
Soft-deleted (30-day restore)
Visible only to you, restorable in one click. 30-day retention, nightly job removes anything older.
- Step 4
Hard-deleted
Irreversible. Account deletion honoured within 7 days and confirmed by email.
Hard limits
What Medical Records Vault does NOT do.
We do not train AI on your records.
We do not sell or share your data with advertisers.
We do not read your documents as a matter of course. We do not have a content-moderation team scrolling through your records.
We do not accept government requests without a valid legal process, and we will tell you about it unless legally prohibited.
We do not retain PII in our logs. Our logger scrubs email, password fields, analysis JSON, and extracted text by default.
Published SLAs
Promises with a timer attached.
Account deletion
We honour account-deletion requests within 7 days. You'll get a confirmation email when the delete is complete.
Breach notification
If we ever have a security incident that touches your data, we'll email every affected user within 72 hours — including what happened, what we know so far, and what you should do.
Abuse / takedown
If someone uploaded a record of yours without consent, write to contact@fourtwos.com. We'll take down the content and confirm within 48 hours.
Responsible disclosure
Found something that looks off?
Email contact@fourtwos.com with the details — please include a reproduction and your expected severity. We publish a security.txt at the RFC-9116 location. We will acknowledge within 3 business days. We don’t yet have a public bug-bounty, but we will credit verified reporters on this page with their consent.
For the curious: our internal incident-response playbook lives in the open. If it breaks we have a plan.
Contact
Reach the right inbox.
contact@fourtwos.com
What this inbox handles
Product questions and account help — put the topic in the subject line.
contact@fourtwos.com
What this inbox handles
Subject “Privacy”: data access, export, deletion, GDPR / DPDP requests.
contact@fourtwos.com
What this inbox handles
Subject “Security”: vulnerability reports and responsible disclosure.
contact@fourtwos.com
What this inbox handles
Subject “Abuse”: a record of yours uploaded without consent, or other misuse.