Skip to content
TurboVOB
Book a demo

Security

This page lists what is true today, specifically enough that you can ask us to demonstrate any of it on a call. Where something isn't in place yet, it's listed as not in place rather than described in language that could be read either way.

What's in place

  • HTTPS only. All application endpoints are served over TLS. There is no plaintext HTTP listener.
  • Encrypted connection to the database. The application connects to its managed Postgres instance over a TLS-required connection.
  • Credentials are not in the codebase. Database credentials, payer credentials, and third-party API keys are held as platform secrets and injected at runtime, not committed to the repository.
  • Authenticated routes are gated. The dashboard, verification submission, verification results, billing, and settings routes all require a valid session, enforced in middleware ahead of the page.
  • Product pages are excluded from web analytics. Analytics is scoped to public marketing pages only, so verification IDs and eligibility responses are never sent to an analytics vendor.
  • The public tools on this site handle no patient data. The VOB worksheet generator runs entirely in your browser and makes no network request at all.

What we don't claim

We are not publishing an encryption-at-rest claim or a data-retention period, because neither is something we can currently demonstrate end to end. We hold no security certification. HIPAA has no certification body, so nobody honestly holds one of those either — see our HIPAA page for what we do instead. If either of these is a requirement for your practice, ask us on a call and we'll tell you exactly where it stands rather than where we'd like it to stand.

Reporting a vulnerability

Email [email protected]. Please include enough detail to reproduce. We won't pursue action against good-faith research that avoids privacy violations and service disruption.

TurboVOB acts as a business associate under HIPAA and signs a Business Associate Agreement with every customer that processes protected health information through the platform.