Security & privacy

Patient privacy is the foundation of the platform, not a feature. This page summarises the controls in plain language.

Who can see clinical material

Clinical cases are never public, never indexable and never visible to guests.
Access requires a manually verified professional profile; case visibility is enforced server-side on every request (matching specialists / all verified / invite-only).
Suspending an account revokes its sessions and access immediately.

Uploads pass an extension allowlist, content (magic-byte) validation and per-type size limits; executables, archives and mismatched content are rejected.
Files are stored under random object keys, never under their original names, with SHA-256 checksums.
Every download re-checks case permissions — there are no public or long-lived URLs, and files are marked non-indexable.

Before publishing, the case owner confirms a versioned de-identification / legal-basis attestation, stored with a timestamp.
Direct patient identifiers are prohibited in descriptions, chat, opinions and files; violations can be reported in one click and are handled by moderators.
The platform supports professional exchange and visualization — it never provides diagnosis or treatment recommendations, and every automated processing step is a technical aid the clinician must verify.

TLS everywhere, strict security headers (CSP, HSTS, frame denial), same-origin enforcement on browser mutations, httpOnly session cookies with server-side revocation.
Rate limiting on login, uploads, search and all write paths; passwords are bcrypt-hashed; reset links are single-use and short-lived.
Sensitive actions land in an append-only audit log (who, what, when, request id) with redacted metadata — admin access included.

Export everything you contributed as JSON at any time (Settings → Privacy & data).
Deleting your account detaches your identity and removes your profile; residual case material follows the documented retention schedule.
Questions or reports: office@smatch.cloud.