We built Cureva with security as the foundation — not an afterthought. Here is exactly how we protect your information.
From the moment you open the app to the moment your data rests in our database — every step is protected.
Your login token is stored in your device's encrypted secure enclave — the same place banking apps store credentials. Never in plain storage.
Face ID or fingerprint required after 30 seconds in the background. Your data stays locked even if someone picks up your phone.
All communication between your app and our servers uses TLS encryption. No plain-text data ever crosses the network.
All data is encrypted at rest using AES-256. Your health records are isolated by account at the database level — other users cannot access your data architecturally.
Our backend validates every request, limits login attempts, and enforces strict rate limits — blocking automated attacks before they can start.
Real-time error tracking detects anomalies instantly. No internal system details are ever exposed to the outside world.
Clear commitments you can hold us to.
Exact standards we implement — no marketing fluff.
| Control | Implementation | Status |
|---|---|---|
| Password hashing | bcrypt, cost factor 12 — industry standard for healthcare | LIVE |
| Encryption at rest | AES-256 — Supabase managed, SOC 2 Type II | LIVE |
| Transport encryption | TLS 1.3 — enforced at infrastructure level, no downgrade | LIVE |
| Auth tokens | JWT signed with 64-char secret, 7-day expiry, stored in OS secure enclave | LIVE |
| Login rate limiting | 5 attempts per 15 minutes per IP — auto-lockout after threshold | LIVE |
| Database isolation | Every query scoped to your user ID — cross-account access is architecturally impossible | LIVE |
| HTTP security headers | CSP, HSTS 1-year preload, X-Frame-Options DENY, X-Content-Type nosniff | LIVE |
| Input validation | All API inputs validated with strict schemas — malformed requests rejected before processing | LIVE |
| Error handling | Internal errors logged server-side only — no stack traces returned to clients | LIVE |
| Regulatory compliance | PIPEDA — data minimization, consent, access rights, breach notification | LIVE |
Our team responds to all privacy and security inquiries within 48 hours.
Contact Privacy Team