Accounts
- Passwords are stored as memory-hard hashes and sign-in attempts are rate limited.
- Capstra staff and clinical reviewers must use an authenticator app (two-step verification). Recovery codes are single-use.
- Sensitive actions require a recent password confirmation. Sessions expire and can be signed out from the account page.
Client isolation
- Every client’s records are isolated in the database by row-level security, in addition to application permission checks.
- Client roles are separate from staff roles; client users see curated progress and review views only.
Connections and publishing
- Provider tokens and publishing secrets are encrypted at rest and never displayed after entry.
- Only the exact revision that passed the required reviews can be published; publications keep a receipt and can be rolled back.
- Security-relevant actions are recorded in an audit log.
Reporting a vulnerability
If you believe you have found a security issue, please contact us through the contact page with “Security” in the company field, and do not access data that is not yours.