Your health data is yours.
We treat your health data the way we'd want ours treated — encrypted, access-controlled, and never sold. Here's exactly how we protect it.
Encryption
In transit
All connections use TLS 1.3. Every request between your browser and our servers is encrypted. Vercel's edge network handles SSL termination with automatic certificate renewal.
At rest
Your data is stored in Neon PostgreSQL with AES-256 encryption at rest. Database backups are encrypted. We use connection pooling with SSL required — no unencrypted database connections.
Passwords
Passwords are hashed with bcrypt (12 salt rounds) before storage. We never store, log, or transmit plaintext passwords. Password reset uses time-limited, single-use tokens.
Sessions
Authentication uses signed JWT tokens with configurable expiry. Sessions are stateless — no session data stored server-side. Tokens are HTTP-only and secure-flagged.
Access Controls
Role-based access
Strict role separation between regular users and administrators. Users can only access their own data. Admin access to health data requires explicit justification and is time-limited.
Rate limiting
API endpoints are rate-limited per IP: 5 login attempts/min, 3 signups/min, 10 uploads/min, 30 chat messages/min, 100 general API calls/min. Exceeding limits returns 429 with retry-after headers.
CSRF protection
All mutating API requests (POST, PUT, PATCH, DELETE) validate the Origin header against the Host header. Cross-origin requests are rejected with 403.
Content Security Policy
Strict CSP headers prevent XSS, clickjacking, and data injection: no iframes (frame-ancestors: none), no inline scripts except Next.js requirements, restricted connect-src to our API and AI provider only.
Security headers
HSTS with 1-year max-age and preload, X-Frame-Options DENY, X-Content-Type-Options nosniff, strict referrer policy, restrictive permissions policy (camera self-only, no microphone/geolocation).
Audit Logging
Every action that touches health data is logged. This isn't just good practice — it's the foundation of our security reviews and access accountability.
What we log
Data Practices
What we do
- Store your data in encrypted PostgreSQL (Singapore region, Neon)
- Process AI queries via Anthropic Claude (US) — API inputs are not used for model training per Anthropic's data usage policy
- Send transactional and product emails via Resend — every non-transactional email includes a working unsubscribe link
- Collect product analytics via PostHog (feature usage, identified by account email; consent-gated in the EU/EEA/UK)
- Measure website usage and ad performance with Google Analytics 4 / Google Ads (restricted mode until accepted in the EU/EEA/UK)
- Track application errors with Sentry, hosted in the EU (Germany)
- Provide full data export (GDPR) — download everything we have on you, from Settings
- Delete your account and all data in our systems immediately on request
- Run automated encrypted backups
What we never do
- Sell your data to anyone, ever
- Use your health data to train AI models
- Share your data with advertisers or data brokers
- Store plaintext passwords
- Send you product emails you can't opt out of
- Access your health data without explicit need and audit trail
- Keep your data in our own systems after you delete your account (third-party processor logs, e.g. error tracking, expire on their own schedules)
Compliance Posture
ByoMap is a self-upload wellness platform: you enter your own data, and we do not act for healthcare providers. ByoMap is not a HIPAA-covered entity or business associate, and we do not currently operate under a HIPAA Business Associate Agreement. Our architecture uses safeguards commonly expected of health-data platforms — encryption in transit and at rest, audit logging, and role-based access controls.