Security Overview

​

Security First

Routiq is built with healthcare security and compliance at its core. We understand that you’re trusting us with sensitive patient data, and we take that responsibility seriously.

​

Security Architecture

​

Infrastructure

• Cloud Provider: Hosted on Vercel and AWS infrastructure
• Database: Supabase with PostgreSQL 15 and row-level security
• Backups: Automated daily backups with point-in-time recovery

​

Application Security

• Authentication: Supabase Auth with JWT tokens
• Session Management: Secure, httpOnly cookies with SameSite protection
• API Security: Rate limiting, input validation, parameterized queries
• Security Headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Error Monitoring: Sentry integration for tracking and resolving issues

​

Data Protection

​

Encryption

​

Data at Rest

Sensitive data is encrypted:

• API keys and credentials: AES-256-GCM encryption with PBKDF2 key derivation
• Database storage: Encrypted at rest via Supabase infrastructure
• Patient data: Protected by row-level security policies

​

Data in Transit

All data transmitted between:

• Your browser and Routiq servers
• Routiq servers and third-party APIs (Cliniko, Chatwoot, Twilio)

Uses TLS 1.2+ encryption for all communications.

​

Data Retention

After retention period, data is permanently deleted.

​

Access Control

​

Authentication

Multi-Factor Authentication (2FA)

• Optional for all users
• Highly recommended for admins
• TOTP-based (Google Authenticator, Authy, etc.)

Password Requirements

• Minimum 8 characters (recommended: 12+)
• No common passwords (checked against breach databases)
• Password strength validation
• Secure password reset flow

​

Authorization

Role-Based Access Control (RBAC) Row-Level Security (RLS) Every database query is scoped to your practice only:

• You can only access data from your own Cliniko account
• Team members can only see data from practices they’re assigned to
• No cross-practice data leakage

​

API Security

• API Key Encryption: All third-party API keys stored with AES-256
• Secure Key Storage: Keys stored in isolated vault
• Key Rotation: Ability to rotate keys without downtime
• API Rate Limiting: Protection against brute force and abuse

​

Compliance

​

Standards & Frameworks

​

Regional Compliance

Australia

• Privacy Act 1988
• Australian Privacy Principles (APPs)
• Spam Act 2003 (for messaging)

United States

• HIPAA (Health Insurance Portability and Accountability Act)
• TCPA (Telephone Consumer Protection Act)
• State privacy laws (CCPA, CPRA, etc.)

European Union

• GDPR (General Data Protection Regulation)
• ePrivacy Directive

​

Monitoring & Incident Response

​

Security Monitoring

• Error Tracking: Sentry integration for application errors
• Access Logs: Authentication and data access logging
• Infrastructure Monitoring: Vercel and Supabase platform monitoring

​

Incident Response

In the event of a security incident:

1. Detection: Automated error alerts via Sentry
2. Investigation: Root cause analysis
3. Notification: Affected users notified within 72 hours (GDPR requirement)
4. Remediation: Fixes deployed and verified

Contact for security issues: support@routiq.ai

​

Access Logging

Application-level events are logged via Sentry:

• Authentication events (login, logout)
• API errors and failures
• Integration sync events
• Campaign execution

Access logs are retained according to our data retention policy.

​

Third-Party Security

​

Subprocessors

Routiq uses trusted third-party services:

​

API Security

When connecting to third-party APIs:

• All API calls use HTTPS/TLS
• API keys encrypted with AES-256-GCM before storage
• Rate limiting implemented to prevent abuse
• Failed API calls logged for troubleshooting

​

Data Privacy

​

Data Minimization

We only collect data necessary for patient reactivation: Required:

• Patient name and contact info
• Appointment history
• Treatment types

Not collected:

• Medical diagnoses
• Test results
• Clinical notes
• Payment information

​

Data Sharing

We never:

• Sell patient data
• Share data with advertisers
• Use data for training AI models or non-service purposes
• Access data without authorization

We only share data with:

• Services you explicitly connect (Cliniko, Chatwoot, Twilio)
• Service providers for infrastructure (Vercel, Supabase)
• Law enforcement (only when legally required)

​

Security Best Practices

​

For Practice Owners

​

For Team Members

• Lock your device when stepping away
• Don’t share login credentials
• Report suspicious activity immediately
• Use approved devices only
• Don’t access from public WiFi without VPN

​

Vulnerability Disclosure

Found a security issue? We appreciate responsible disclosure:

1. Email: support@routiq.ai
2. Include: Detailed description, steps to reproduce, impact
3. Don’t: Publicly disclose before we’ve fixed the issue
4. We will: Acknowledge within 48 hours and work to remediate

​

Security Certifications & Compliance

​

Questions?

For all support and security questions:

• Email: support@routiq.ai

Review Compliance Docs

Learn about HIPAA, GDPR, and other compliance requirements