Security

Security Architecture

U.S. HealthFront is built on a HIPAA-grade secure architecture, designed to protect your data at every layer. While we do not process Protected Health Information (PHI), we maintain enterprise-level security standards to ensure the confidentiality, integrity, and availability of all information.

Infrastructure Security

Cloud Infrastructure

Our platform runs on Google Cloud Platform (GCP), leveraging enterprise-grade security:

• Private Cloud SQL database instances with encrypted connections
• Cloud Run serverless containers with automatic scaling and isolation
• VPC (Virtual Private Cloud) connectors for secure network communication
• IAM (Identity and Access Management) for granular access control
• Automated security updates and patches

Encryption

All data is encrypted both in transit and at rest:

• Encryption in Transit: All connections use HTTPS/TLS 1.2+ with enforced secure protocols
• Encryption at Rest: Database and storage are encrypted using industry-standard AES encryption
• Secure Connections: Database connections use encrypted Unix sockets via VPC

Application Security

Authentication & Authorization

We implement multiple layers of access control:

• Email-based magic link authentication (passwordless)
• Role-based access control (ADMIN/MEMBER) with granular permissions
• Protected routes via middleware that require authentication
• Session management with secure JWT tokens
• Automatic session expiration and secure logout

Security Headers

We enforce strict security headers to protect against common web vulnerabilities:

• Content Security Policy (CSP): Prevents XSS attacks and restricts resource loading
• HTTP Strict Transport Security (HSTS): Forces HTTPS connections
• X-Frame-Options: Prevents clickjacking attacks
• X-Content-Type-Options: Prevents MIME-type sniffing
• X-XSS-Protection: Additional XSS protection layer
• Referrer-Policy: Controls referrer information sharing

Input Validation & Sanitization

All user input is validated and sanitized to prevent injection attacks:

• URL validation and sanitization
• Organization ID validation (CUID format)
• Document topic validation (enum-based)
• XSS sanitization for all user-generated content
• SQL injection protection via Prisma ORM (parameterized queries)

Database Security

Our database is protected with multiple security layers:

• Prisma ORM prevents SQL injection through parameterized queries
• Private Cloud SQL instance (not publicly accessible)
• Encrypted connections via VPC connector
• Database access restricted to application service accounts
• Regular automated backups with encryption
• Audit logging for all database operations

API Security

All API endpoints are secured with multiple protection mechanisms:

• Rate limiting to prevent abuse and DoS attacks
• Cron endpoints protected with secret-based authentication
• Admin endpoints require authentication + ADMIN role
• Timing attack protection using constant-time comparisons
• Input validation on all endpoints
• CSRF protection via NextAuth.js

Monitoring & Incident Response

We maintain comprehensive monitoring and logging:

• Audit logging for all sensitive operations
• Cloud Logging integration for real-time monitoring
• Error tracking and alerting
• Security incident response procedures
• Regular security audits and assessments

Compliance & Certifications

While we do not process PHI, we maintain security standards aligned with:

• HIPAA-grade security architecture
• Industry best practices for data protection
• Google Cloud Platform security standards
• OWASP Top 10 security guidelines

Security Best Practices

We follow industry-standard security practices:

• Defense in Depth: Multiple layers of security controls
• Least Privilege: Users and services only have necessary permissions
• Secure Defaults: Strict security settings by default
• Regular Updates: Automated security patches and updates
• Security by Design: Security built into every component

Vulnerability Management

We actively protect against common attack vectors:

• SQL Injection: Protected via Prisma ORM parameterized queries
• XSS (Cross-Site Scripting): Mitigated with CSP headers, input sanitization, and output escaping
• CSRF (Cross-Site Request Forgery): Protected via NextAuth.js built-in mechanisms
• Timing Attacks: Protected using constant-time comparison functions
• Brute Force: Rate limiting on authentication endpoints
• DoS (Denial of Service): Rate limiting on all API endpoints

Data Protection

Your data is protected through:

• Regular automated backups with point-in-time recovery
• Data retention policies aligned with business needs
• Secure data deletion procedures
• No data sharing with third parties without explicit consent
• Compliance with data protection regulations

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly. We take security seriously and will respond promptly to any legitimate security concerns.

Contact Us

For questions about our security practices or to request additional information, please contact us: