Security

Last updated: June 2025

Infrastructure

Application hosted on SOC 2 compliant infrastructure
All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
Automated backups with point-in-time recovery
DDoS protection and rate limiting on all endpoints
Separate encryption key management from application data

Application Security

Static analysis via Brakeman on every deployment
Dependency vulnerability scanning via bundler-audit
Rate limiting on authentication, API, and webhook endpoints (Rack::Attack)
CSRF protection on all forms
Content Security Policy headers enforced
PHI parameter filtering prevents sensitive data from appearing in logs
SMS template linting at boot prevents PHI leaks in patient communications

Authentication

Password Security

All passwords hashed with bcrypt. We never store or log plaintext passwords.

Session Management

Sessions expire after 15 minutes of inactivity. Sessions are bound to the originating IP and user agent.

Brute Force Protection

Auto-ban after 20 failed login attempts from the same IP (1 hour cooldown). Sign-in attempts are rate-limited to 10 per minute per IP.

Two-Factor Authentication

Optional TOTP-based 2FA available for all accounts. Recommended for Owner and Manager roles.

Data Isolation

Each practice is a separate tenant. All database queries are automatically scoped to the current tenant via acts_as_tenant. Cross-tenant access returns a 404 — not a 403 — to prevent enumeration attacks. There is no way for one practice to access another practice's data.

Payment Security

Credit card data is handled entirely by Stripe. We never see, store, or transmit card numbers. We store only a Stripe token and the last 4 digits for display. Card input uses Stripe Elements — a secure iframe where card data goes directly to Stripe's PCI-DSS Level 1 certified servers without touching ours.

Responsible Disclosure

If you discover a security vulnerability, please report it to security@schedulite.com. We take all reports seriously and will respond within 48 hours. We will not pursue legal action against researchers who report vulnerabilities responsibly.