Security

Security is foundational to JoinVet. Veterinary clinics trust us with their client, patient, and billing data, and we work to protect that trust with layered technical and organizational safeguards. This page summarizes our security practices. For security questions or to report a concern, contact info@joinvet.com.

1. Data Encryption

• In transit: all traffic between your browser and the Service is encrypted with TLS (HTTPS). Unencrypted connections are not accepted.
• At rest: our production database is hosted on Neon (PostgreSQL) with encryption at rest for all stored data and backups.
• Credentials: passwords are never stored in plain text; they are hashed with bcrypt using per-user salts.

2. Payment Security

• All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor.
• Full payment card numbers never touch or persist on JoinVet servers. Checkout and payment method management occur on Stripe-hosted, secured surfaces.
• Billing events received from Stripe are verified with cryptographic webhook signatures and processed idempotently, protecting against forged or replayed events.

3. Access Control

• Authentication is enforced across the application, with session management handled by industry-standard tooling (Auth.js).
• Role-based access control separates platform administrators, clinic administrators, and clinic staff; users can only access data belonging to their own clinic.
• Internal access to production systems is limited to authorized personnel on a need-to-know basis.

4. Application Security

• Input validation on all API boundaries using strict schema validation (Zod), with strongly typed code (TypeScript strict mode) throughout.
• Rate limiting on sensitive endpoints to mitigate abuse and brute-force attempts.
• Automated test suites covering critical billing, authentication, and webhook flows run before every release.
• Dependencies are monitored and updated regularly to address known vulnerabilities.

5. Infrastructure and Availability

• The Service runs on reputable cloud infrastructure providers with strong physical and network security certifications.
• Databases are automatically backed up, enabling point-in-time recovery in case of incident.
• Full audit logging of billing events provides a verifiable history of every subscription change.

6. Messaging and Communications

SMS and email notifications are delivered through vetted communication providers acting under our instructions. Mobile opt-in data and SMS consent are never shared with or sold to third parties or affiliates for marketing purposes — see our Privacy Policy for details.

7. Incident Response

We maintain procedures to detect, investigate, and respond to security incidents. If an incident affects your data, we will notify you without undue delay and in accordance with applicable law, along with the steps we are taking to remediate it.

8. Responsible Disclosure

We appreciate the work of security researchers. If you believe you have found a vulnerability in the Service, please report it to info@joinvet.com with enough detail to reproduce the issue. We ask that you do not access other users' data, disrupt the Service, or publicly disclose the issue before we have had a reasonable opportunity to address it.

9. Contact

For any security-related questions, contact us at info@joinvet.com.