Security

Provider data comes from public government registries: CMS NPPES and PECOS, the OIG LEIE, SAM.gov, OFAC, state Medicaid exclusion lists, and state licensing boards. It describes providers in their professional capacity. MedFabric does not process patient data or Protected Health Information (PHI).

Customer data is limited to your account details, your API keys, the provider rosters you choose to monitor, webhook subscriptions, and usage records. Payments are handled by Stripe; card numbers never reach our servers.

• Sign-in is handled by Clerk. Dashboard pages require an authenticated session.
• API keys are stored only as SHA-256 hashes. A key is shown once, when you create or rotate it, and can't be displayed again — not even by us.
• You can create, rotate and revoke keys at any time from the dashboard. Rotation takes effect immediately.
• Keys are scoped by plan, and every API request is authenticated and metered.

Rosters, monitoring alerts, alert acknowledgements and webhook subscriptions are scoped to your account or organization. One customer can't read another customer's roster or alerts, and acknowledging an alert hides it only for your team.

• Webhook endpoints must use HTTPS.
• Every delivery is signed with HMAC-SHA256 using a per-subscription secret, sent in the X-MedFabric-Signature header with a timestamp, so you can verify it came from us and reject replays.
• Events are sent only for providers on your own roster.
• A subscription that fails ten deliveries in a row is disabled automatically.

The application runs on Google Cloud (Firebase App Hosting). Data is stored in a managed Postgres database (Neon), and connections to it require TLS. Database credentials are held as runtime secrets, not in source code.

Error reports are scrubbed before they leave our servers: request bodies, cookies, query strings and authorization headers are removed, and anything resembling an API key or bearer token is redacted.

A compliance tool is only safe if it never claims more than it checked. MedFabric returns “compliant” only when it can confirm it:

• A licence matched to a provider by name alone, licence data older than 60 days, or an exclusion list past its freshness threshold produces “needs review”, not “compliant”.
• When a state's records aren't yet matched to provider NPIs, a lookup there reports “not checked” — never “no license found” or “no adverse action found”.
• Every result names its sources and when each was last refreshed. Per-state status is published at /coverage.

Our standard service doesn't involve PHI, but many customers are HIPAA-covered entities or business associates. We sign BAAs on the Enterprise plan.

If you believe you've found a security issue, please email api@medfabric.org with “Security report” in the subject. Please don't access other customers' data or disrupt the service while testing.