Trust & Security
Security
Healthcare data requires a higher bar. Here's how MediFlow AI protects it — both the certifications we hold and the technical controls actually built into the system.
Certifications
HIPAA Compliant
SOC 2 Type II
ISO 27001
Technical Safeguards
These are real controls implemented in the MediFlow AI codebase, not marketing claims.
Password HashingUser passwords are hashed with bcrypt before storage — the platform never stores or handles plain-text passwords.
JWT AuthenticationEvery authenticated request carries a signed JWT with an expiry. Tokens are validated on every protected endpoint.
Role-Based Access ControlAdmin, doctor, pharmacist, and patient roles each have distinct, enforced permissions — endpoints reject requests outside a role's scope.
Full Audit LoggingEvery action is written to an audit log capturing who performed it, what changed, when, and the before/after state — reviewable by admins.
Encrypted Data ConnectionsConnections between the application and the PostgreSQL database are encrypted in transit.
Security questions from prospective customers or partners? See our Contact page.