Security
Last updated: August 24, 2026
Security is a foundation of the platform, not a feature. Here is how ElderCareHub protects family health information.
Encryption
TLS 1.2+ for all traffic in transit.
AES-256-GCM field-level encryption for sensitive free-text fields (medication instructions, visit notes, observation notes, insurance details).
Every uploaded document is encrypted at rest with AES-256-GCM before touching disk.
Access control
Authentication uses salted bcrypt password hashing and server-side sessions stored as SHA-256 token hashes with revocation support.
Every request is authorized server-side against the person + resource + capability model. There are no client-side permission shortcuts.
Household boundaries are enforced on every query — a member of one household can never read another household's records.
Application security
Strict Content-Security-Policy, X-Frame-Options DENY, and modern security headers on every response.
CSRF protection through same-site cookies and Next.js server actions.
Rate limiting on authentication and sensitive endpoints.
Input validation with schema enforcement (Zod) on every mutation.
Audit and monitoring
An append-only audit log records logins, record access, medication changes, permission changes, sharing, exports, safety events, and AI executions.
Household administrators can review household audit activity; platform operators review system-level events.
Responsible disclosure
Found a vulnerability? Email security@eldercarehub.app. We respond within 48 hours and appreciate coordinated disclosure.