Security
How 24Therapy is built and operated.
Security
هذه الصفحة بالإنجليزية، لأن النص الملزم قانونًا هو النص الإنجليزي. إن أردت شرحًا لها بالعربية فاكتب إلينا من صفحة التواصل وسيشرحها لك شخص.
The short version
Every read is written down
Opening a chart appends a row to a log nobody can edit, including us.
A role is a list, not a rank
An unrecognised role is denied rather than quietly allowed, and every clinical query is scoped to one practice.
We say what is not finished
The compliance work still in progress is named on this page rather than implied to be done.
Authentication
Sessions are opaque tokens stored as hashes, held in an httpOnly, Secure, SameSite cookie. There is no token in browser storage for a script to read. Signing out, changing a password or resetting a password revokes every existing session immediately.
Authorisation
Roles are an explicit allowlist rather than a hierarchy of numbers, so an unrecognised role is denied rather than silently permitted. Every query for clinical data is scoped to the practice that owns it, and the scoping is applied by the data layer rather than remembered by each caller.
Logging
Application logs contain request identifiers, never transcript text, note content, patient names or crisis indicators. Server errors are recorded with the route, the status and a stack trace; the request body, the query string and any path segment that could be an identifier are dropped before the record is written. There is no session replay and no client-side analytics.
Reporting a vulnerability
Email security@24therapy.app. We will acknowledge within two business days.