Security

Architecture

The web app runs on Vercel; the database and business logic on Convex; authentication on WorkOS. Each organization (practice or clinic) is an isolated space: every database query verifies the user’s membership in the organization before returning a record.

Patients have no account. They receive links with a unique 48-hex-character token per survey; the token is the only credential and opens that survey only.

Encryption

All traffic is encrypted with TLS 1.2 or higher. Data at rest is encrypted in our providers’ infrastructure (Convex, Vercel, WorkOS, Stripe). Passwords do not exist in Salumbra: authentication is handled by WorkOS with email, magic links and identity providers.

Access control

Roles per organization (administrator and member) with explicit permissions in code; sensitive actions (settings, billing, deletion) require the administrator role.

Audit log of actions on patients, medical events and surveys, with user, date and changes, visible to administrators under Settings > Security.

Public endpoints (response submission, waitlist) are rate-limited per client and per survey and validate payload size and shape.

Providers (subprocessors)

Each provider receives only what its role needs:

• Convex: database, functions and scheduled jobs. United States.
• Vercel: hosting and delivery network. United States and global network.
• WorkOS: authentication, organizations and sessions. United States.
• Stripe: clinician payments and invoices. Receives no patient data.
• Postmark: transactional email (invitations, reminders, notifications).
• Meta (WhatsApp Business Platform) and Twilio: patient message delivery; they receive the number and message text.
• PostHog: product analytics, with denylists that block patient fields and no session recording on clinical surfaces.
• Sentry: error monitoring, with no request bodies, no cookies, and patient-link tokens removed from URLs.

Backups and continuity

Convex takes daily backups of the production database. Application availability is checked automatically every five minutes. Code deploys from reviewed branches with automated tests and a full build before each merge.

Retention and deletion

Data is kept while the account is active. A clinician can archive or delete patients from their profile; deleting removes their data, responses and messages. Deleting the organization removes all of its patients, surveys and members. Deletion is immediate in production and propagates to backups on their rotation cycle.

Billing data is kept as long as tax law requires. The anonymized research export removes name, contact details, exact date of birth and clinical identifiers.

Incident response

If we detect or are told of a breach affecting personal data, we contain it, assess its scope and notify the affected responsible clinicians without undue delay, with what they need to meet their own obligations to patients and authorities.

Responsible disclosure: if you find a vulnerability, write to seguridad@salumbra.com. We reply within two business days and will not pursue anyone who researches in good faith without accessing third-party data.

What we do not do yet

We hold no external certification (SOC 2, ISO 27001). We do not offer data residency in Mexico; our providers operate in the United States. We do not offer enterprise single sign-on on the Pro plan. We publish these limits so the decision to use Salumbra is made with complete information.