Security at FlexCare

All data transmitted over HTTPS / TLS 1.3. No HTTP connections permitted.

Database encrypted with AES-256. Backups encrypted before upload.

Sensitive fields (phone, email, Aadhaar) encrypted at the database column level.

Prescriptions, lab reports, scans stored encrypted on Cloudflare R2. No public URLs.

Row Level Security policies enforce tenant isolation at the database level — not just application code.

Even if a bug exists in application code, the database will block cross-tenant queries.

Each clinic's files are stored under a unique tenant prefix. No shared file namespaces.

Each clinic gets an isolated subdomain. No shared session cookies between tenants.

Phone OTP required for every login. No password-only access.

Access tokens expire in 15 minutes. Refresh tokens rotate on every use.

7 distinct roles (Super Admin, Clinic Admin, Doctor, Nurse, Receptionist, Pharmacist, Patient). Each role sees only what it needs.

OTP requests: 3/15 min. Login attempts: 5/10 min. API: 1,000 requests/min/tenant.

Platform super admin requires TOTP (Google Authenticator) + IP whitelist.

Who accessed what, when, from which IP, with what result — on every sensitive operation.

Audit logs cannot be modified or deleted — not even by platform administrators.

Audit records retained for 7 years in line with healthcare compliance standards.

Clinic admins can export their full audit log at any time.

Complete database snapshot every 24 hours, encrypted, stored in a separate region.

Incremental backups every 6 hours for point-in-time recovery.

Recovery Time Objective: system back online within 4 hours of a major failure.

Recovery Point Objective: maximum data loss of 6 hours.

Backup restoration is tested every quarter. An untested backup is not a backup.

Automated monitoring alerts for suspicious login patterns, bulk data access, and rate limit breaches.

Affected clinic admins notified within 24 hours of a confirmed breach.

Significant breaches reported to CERT-In within 72 hours as required by law.

Root cause analysis published internally within 7 days. Affected clinics receive a full incident report.