This page is maintained by the Clincue team as our public description of the platform's current security posture. It is not an independent audit report or certification, and it is not a substitute for the contractual obligations set out in our DPA and Terms. Where a specific compliance framework matters to your clinic, please contact security@clincue.com.
1. Encryption
- All connections to clincue.com, the dashboard, and the Patient Channels enforce TLS 1.2 or higher, with modern cipher suites.
- The primary database and object storage are encrypted at rest using AES-256 managed by our infrastructure provider.
- Session tokens are stored in the browser's local storage and never sent to unauthorised origins; API bearer tokens are attached only to same-origin requests to our API.
2. Access control and tenant isolation
- Every table containing clinic data has row-level security enabled and scoped by clinic membership; the database itself enforces isolation between clinics.
- Multi-factor authentication is available for all clinic accounts.
- Clincue engineers access production data only through audited, least-privilege pathways. Direct read access to raw patient conversations is restricted to on-call incident response.
- Service-role credentials are stored only on the server side, injected as environment variables at deploy time, and never shipped to the browser.
3. Application security
- Server-side validation of every user input using strict schemas (zod).
- Signed and verified webhooks for every external integration (Paddle, Twilio).
- Rate limiting and abuse detection on the public API surface.
- Content Security Policy and strict CORS on production origins.
- Regular dependency scanning; security patches applied within 7 days of disclosure for high-severity issues.
4. Backups and business continuity
- Continuous WAL-based backups with a 7-day point-in-time recovery window.
- Nightly logical snapshots retained for 30 days.
- Recovery procedures tested at least once per quarter.
- Multi-region redundancy at the CDN / edge layer via Cloudflare.
5. Logging, monitoring, observability
- Structured application logs for all API routes and server functions.
- Security-relevant events (login, password change, invite acceptance, subscription changes) captured in an append-only audit trail retained for 12 months.
- Anomaly alerting on webhook failures, error rate spikes, and job-queue backlogs.
6. Incident response
- Documented on-call rota with defined severity levels and response-time targets.
- Personal Data breaches communicated to affected clinics within 48 hours of confirmation, in line with our DPA.
- Post-incident reviews shared with affected clinics; systemic learnings folded into the platform.
7. Sub-processor security
We select sub-processors with strong published security postures. See the full list and their roles in the DPA. International transfers rely on the UK IDTA and/or EU Standard Contractual Clauses.
8. Responsible disclosure
We welcome responsible disclosure of security issues. Please email security@clincue.com with details, a proof of concept if applicable, and any impact analysis. We aim to acknowledge within 2 business days and resolve high-impact issues within 30 days. We do not currently run a paid bug bounty; we do publicly credit reporters (with consent) in release notes.
9. Current limits and roadmap
We are honest about where we are. Clincue is not currently SOC 2 / ISO 27001 / HIPAA-certified. We follow the technical controls expected of a modern SaaS platform, and we are on a roadmap toward formal attestations as we grow. Clinics that require a specific certification today should discuss their needs with us before signing up.
10. Contact
Security team — security@clincue.com.