Information security policy

This policy applies to all Preventa Health systems, source code, infrastructure, employees, contractors and sub-processors that process or have access to customer or clinical data. It covers the Preventa Health web application, edge functions, the managed database, file storage, email infrastructure and supporting back-office tooling.

• Founders / leadership own the information security programme and risk acceptance.
• Engineering implements technical controls, secure development practices and incident response.
• Clinical leadership owns validation workflows and clinical data handling.
• All staff are responsible for following this policy and reporting suspected incidents without delay.

• Least-privilege access enforced through six-role RBAC and row-level security in the database.
• Multi-factor authentication is required for all internal accounts that can reach production data.
• Access reviews are performed at least quarterly and when a role changes.
• Accounts are revoked within one business day of an employee or contractor leaving.

• TLS 1.3 for all data in transit.
• AES-256 for data at rest, including database, backups and object storage.
• Keys are managed by the hosting provider’s managed KMS. Application code never handles raw key material.
• No passwords are stored. Sign-in is invite-only via a 6-digit email OTP with 5-per-hour rate limits per email, 20-per-hour per IP, and a 5-attempt lockout.

• All changes are made through reviewed pull requests with mandatory peer review.
• Automated dependency scanning and secrets scanning run on every release.
• Database changes are shipped as migrations with explicit rollback paths.
• Security findings are tracked, prioritised and resolved according to the vulnerability management SLA published on the security posture page.

• Sub-processors are documented in the public sub-processor register and reviewed at least annually.
• New sub-processors are assessed for security posture, data-residency and GDPR alignment before onboarding.
• Data processing agreements are in place with every sub-processor that handles personal data.

Security incidents are handled in line with our incident response plan. Confirmed personal-data breaches are reported to the supervisory authority within 72 hours, in line with GDPR Article 33, and to affected data subjects without undue delay when the risk is high.

This policy is reviewed at least annually, and whenever a material change to the platform, threat landscape or regulatory environment occurs. The current version is the one published on this page.