Security
Security is built into Leadia at every layer. Here is what we do and how to reach us.
Report a Vulnerability
Do not report security vulnerabilities through public GitHub issues.
Email: security@getleadia.com
Include in your report:
- Description of the vulnerability
- Steps to reproduce (proof of concept if possible)
- Impact assessment (what data or functionality is affected)
- Your name or handle for attribution (optional)
We will acknowledge receipt within 48 hours, provide an initial assessment within 5 business days, and credit you in our release notes once patched (if you want attribution). We do not currently offer a paid bug bounty.
Compliance
| Standard | Status | What it means for you |
|---|---|---|
| HIPAA | Supported | Patient health information is encrypted and every access is logged. A Business Associate Agreement is available. |
| TCPA | Supported | Consent is recorded before texting, opt-outs are honored immediately, and quiet hours are enforced. |
| CAN-SPAM | Supported | Every email includes an unsubscribe link and opt-outs are honored. |
| GDPR / CCPA | Supported | You can export or delete a person's data on request. We never sell data. |
| SOC 2 Type II | Planned | Controls are being put in place ahead of a formal audit. |
Your data stays yours
- Every customer's data is kept separate at the database level. One practice can never see another's records.
- Contact details and patient information are encrypted at rest with industry-standard AES-256 encryption.
- All traffic is encrypted in transit with modern TLS.
- Encryption keys are never stored alongside your data.
Access and accountability
- Secure, time-limited sign-in sessions.
- API keys are stored in hashed form, so they can't be read back, even by us.
- Every user and AI action is recorded in an audit log, and access to patient information is logged separately.
- Automatic limits on request volume protect accounts from abuse.
Trusted infrastructure
Leadia runs on established providers that maintain independent security certifications (such as SOC 2 and ISO 27001), including Vercel, Supabase, Twilio and Stripe. Business Associate Agreements with the providers that handle patient information are required before any practice's patient data is processed.
Ongoing protection
Our code is scanned automatically for vulnerable software components and leaked credentials, and security updates are applied promptly.
Questions
Need a security questionnaire completed or a copy of our BAA? Email security@getleadia.com.