Security

Candidates trust MedTality with their work history, credentials and assessments, and employers trust it with their hiring. This page describes how we protect that information: how you sign in, who can see what, where it is stored, how files and credentials are checked, and how we respond to problems.

We describe only what is true today. Where we do not yet hold a certification, we say so.

Ways to sign in

• Email and password. Your email address is confirmed before the account is used. Passwords are stored only in hashed form, which cannot be read back, and changing your password signs out your other sessions.
• Your phone. Phone numbers are confirmed with a one-time code that expires after five minutes and allows only three attempts.
• Google, Apple or LinkedIn. You can sign in with one of these accounts instead of a password.

Two-step sign-in

You can turn on a second step, so a correct password is not enough: we also send a code to your phone. Backup codes let you in if you lose the phone. Codes are stored only in hashed form, and after five wrong codes, sign-in is locked for 15 minutes.

Sessions and devices

• On the web. The cookie that keeps you signed in belongs to this website and cannot be read by scripts on the page.
• In the mobile app. Your session is kept in the device's secure storage, and you can lock the app behind Face ID or your device's biometrics.
• Where you are signed in. Settings lists every session, with its device, browser and IP address. You can sign out any one of them, or all but the one you are using, and revoke a mobile device.
• Your activity. Settings also shows a record of important actions on your account, so you can spot anything you did not do.

Before our servers return or change anything, they check who is asking: that you are the candidate the record belongs to, or a member of the organization it belongs to, with the role that action needs. Organization admins manage members and settings; members work with roles and candidates.

An employer sees a candidate's profile and scorecards only when the candidate applied to one of its roles, matches one of its roles, or is in one of its talent pools. Practice sessions are never shown to employers.

Important actions are written to an audit record with who did them and when: changes to an organization and its members, a role being published or closed, an application moving stage, a file being opened, a credential being issued, a payment being refunded, a device being revoked, and a request to export or delete an account.

• App data and files. Profiles, assessments, messages, scorecards and the documents you upload are stored with our database provider, Convex.
• Images. Profile pictures and organization logos are stored with Cloudflare R2, and shared through links that expire.
• The website. Served by Vercel.
• Payments. Card details go straight to Stripe, which is certified to the payment card industry's highest security level. They never pass through or stay on our servers.

Our providers store and process information mainly in the United States. Our subprocessors page lists every one and what it does.

• In transit. Every connection to MedTality, and between MedTality and its providers, is encrypted with HTTPS.
• At rest. Our providers encrypt the data they store for us.
• Calendar access. The keys that let us reach a calendar you connect are encrypted again by us, with AES-256-GCM, before they are stored.
• Secrets. Invitation links and sign-in states are stored only in hashed form, and the keys our servers use are kept out of our code.

Every file you upload is held in quarantine until a malware scanner has checked it. A file the scanner finds infected is deleted, and only a clean file becomes part of your profile. Uploads have size limits, and a file that is never attached to anything is deleted within four days.

Some credentials, such as a National Provider Identifier, are checked against the official public registry and checked again on a schedule, so a credential that lapses does not stay marked as verified. An uploaded certificate can also be read to check that it matches what was entered, and one that looks inconsistent is flagged rather than accepted.

• Least information. Each request to an AI model carries only what that task needs.
• No training. Our AI provider, OpenAI, does not use what we send to train its models, and we ask it not to store our requests.
• No patient information. The examiner is instructed never to ask for or accept real patient information, and the scorer flags anything that looks like it.
• Evidence, not trust. A score must cite what was said, and a critical failure that does not cite the candidate's own words is dropped. Our Assessment and AI policy has the details.

The MedTality app is not built to hold patients' health information, and does not need it. Please do not share it with us, including in assessment answers, messages and uploads.

The exception is Virtual Staff, where a worker we place with a practice may work with its patient records. They do that only inside the practice's own systems, under our Business Associate Agreement, which we sign with the practice before the worker is given any access.

You pay on Stripe's own checkout page. MedTality receives only whether a payment succeeded, failed or was refunded, and a link to your receipt. Messages from Stripe to our servers are checked to be genuine before we act on them.

If we find that your information may have been exposed, we:

• contain the problem and find its cause;
• tell you without undue delay, and within the time the law sets, what happened, what information was involved and what you can do;
• notify regulators and the organizations involved where the law or our agreements require it;
• fix the cause, so it does not happen again.

For a practice with a Business Associate Agreement, the agreement sets how and when we notify it.

MedTality does not hold a SOC 2 report, an ISO 27001 certificate or any other security certification today. There is also no official HIPAA certification for any company. When that changes, we will say so here.

A security problem

If you think you have found a security problem, tell us through Support with the steps to reproduce it.

We will not take legal action against research done in good faith that follows these rules:

• Test only with accounts you own, and do not access, change or delete other people's information.
• Do not disrupt the service, send spam, or use social engineering or physical attacks.
• Give us reasonable time to fix the problem before you share it with anyone else.

Your account

If you think someone else has signed in to your account, change your password, sign out your other sessions in Settings, turn on two-step sign-in, and let us know.