Security Practices

Last updated: 22 August 2026 · Report vulnerabilities: security@doctorsmyagency.com

🔐

End-to-end encryption

All data in transit is protected by TLS 1.2+. WhatsApp tokens are encrypted at rest using AES-256-GCM.

🏥

Per-clinic data isolation

Every clinic's patients, messages, and appointments are logically isolated. No cross-clinic data access is possible.

🛡️

HMAC webhook verification

All inbound Meta webhook payloads are verified using HMAC-SHA256 with your App Secret before processing.

🔑

Secure authentication

Passwords hashed with bcrypt. JWT tokens with 7-day expiry. Rate limiting on all login endpoints.

📊

Audit logging

All AI actions, appointment changes, and staff logins are logged with timestamps for audit trail.

⚡

Rate limiting

All API endpoints are rate-limited. Auth endpoints have stricter limits (20 req/15 min). Webhook replay attacks are mitigated by Meta's delivery deduplication.

Data encryption

In transit

All web traffic served over HTTPS with TLS 1.2 or higher
HTTP Strict Transport Security (HSTS) header enforced in production
All API-to-API calls (Meta Graph API, Stripe, Twilio, AI providers) use HTTPS

At rest

WhatsApp Business API access tokens encrypted with AES-256-GCM before database storage
Encryption key stored as a server environment variable, never in source code or database
Passwords hashed with bcrypt (minimum cost factor 12) — plain-text passwords are never stored
Staff invitation tokens and email verification tokens are single-use and expire within 24–48 hours

Authentication & access control

JWT-based authentication with 7-day token expiry for doctor and staff sessions
Separate authentication flows for Doctors, Staff, Superadmin — no privilege escalation between roles
Auth endpoints rate-limited to 20 requests per 15 minutes per IP
Email verification required before account activation
Password reset tokens are single-use, HMAC-signed, and expire in 1 hour
Staff accounts require invitation via verified clinic-owner email
Session cookies are HttpOnly, Secure, SameSite=Lax

WhatsApp API security

HMAC-SHA256 webhook verification — every inbound Meta webhook POST is verified against the X-Hub-Signature-256 header using your Meta App Secret before any processing occurs
Access token encryption — your WABA access token is encrypted with AES-256-GCM immediately on receipt and stored only in encrypted form; it is decrypted in memory only when needed to make an API call
Encrypt/decrypt round-trip check — during WhatsApp connection, the access token is encrypted and immediately decrypted to verify the encryption key is correct before the token is saved
WABA subscription verification — after connecting WhatsApp, we immediately subscribe the WABA to the webhook app and provide a self-service health check to verify subscription status
Token never exposed in logs — access tokens are masked in all log output
One active account per clinic — unique constraint prevents duplicate WABA or phone number registrations

Infrastructure security

API server runs Node.js on a dedicated cPanel/Passenger instance; not shared with other tenants' processes
MySQL database with per-user access controls; the API user has only the minimum required privileges
All database queries use parameterised statements (Prisma ORM) — no raw string interpolation in SQL
Input validation and sanitisation on all API endpoints
Helmet.js security headers on all API responses (XSS protection, content type sniffing prevention)
CORS policy restricts API access to the registered frontend domain
Rate limiting applied globally (200 req/15 min) and per-endpoint
Dependency vulnerabilities audited on each deployment

Patient data protection

Patient records are scoped to the owning clinic — no patient can be accessed by another clinic
Opt-out / STOP requests are processed immediately and stored permanently; opted-out patients cannot be re-messaged by the AI
Patient portal magic-link tokens expire and are single-use
Special-category health data (diagnoses, prescriptions) should not be transmitted via WhatsApp — clinics are advised of this in platform onboarding

Incident response

In the event of a security incident affecting personal data:

We will assess and contain the incident within 24 hours of detection
Affected clinic owners will be notified within 72 hours, as required by GDPR Article 33
We will provide a full incident report including cause, scope, and remediation steps
If the incident involves WhatsApp data, Meta will be notified per Meta Platform Terms requirements

Responsible disclosure

Found a security vulnerability?

We welcome responsible disclosure from security researchers. If you discover a vulnerability in our platform, please report it to us before making it public so we can fix it first.

Email: security@doctorsmyagency.com

Please include a description of the vulnerability, steps to reproduce, potential impact, and any proof-of-concept (non-destructive only). We will acknowledge your report within 3 business days and aim to resolve confirmed issues within 30 days.

We do not take legal action against researchers who follow responsible disclosure guidelines. We do not offer a bug bounty programme at this time but will publicly credit researchers who request it.

Third-party security

We use the following security-critical third-party services:

Meta WhatsApp Cloud API — see Meta's security documentation
Stripe — PCI DSS Level 1 certified payment processor; we never handle raw card data
Twilio — ISO 27001 certified; used for SMS fallback only
Cloudinary — SOC 2 Type II; used for clinic logo storage only

All sub-processors are evaluated for security posture before integration.