Security

What we actually do — and what we don't claim.

What we do

• Submissions encrypted with Fernet (AES-128-CBC + HMAC) before storage; the key lives in a secret manager, never the repo.
• Role-based access: practice admins manage forms, users, exports and retention; staff can view the inbox but cannot export. Session tokens expire after 30 minutes idle.
• Immutable, hash-chained audit log of every submission view, list, export, BAA signing and retention run — database triggers forbid editing or deleting entries.
• Per-practice retention policies with automatic deletion of aged submissions; the deletion itself is audit-logged.
• A form cannot accept submissions until its practice's BAA is executed — enforced in code, not just policy.
• Honest boundary: no 'HIPAA certified' or 'HIPAA compliant' product claims — HHS/OCR does not certify software, and compliance is a property of how a practice operates its safeguards, not a badge.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+careform@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.