Security & Privacy
How TekMeDoc protects accounts, sessions, and health-related data in the platform.
Encrypted transport
API and web traffic use TLS. Authentication tokens for web clients are stored in httpOnly, Secure, SameSite cookies—not in JavaScript-accessible storage.
Access controls
JWT access tokens (short-lived), server-stored refresh tokens, email/phone verification, and role-based routes protect patient and clinical data.
Private file storage
Medical documents and uploads are stored privately in object storage. Access uses time-limited signed URLs after authorization checks.
Admin two-factor authentication
Administrator accounts can enable TOTP authenticator apps for an additional login step.
CSRF protection
State-changing requests from the web app use double-submit CSRF tokens alongside cookie-based sessions.
Audit logging
Security-sensitive actions such as login, logout, and password changes are recorded for administrative review.
Additional safeguards
- Rate limiting on authentication and OTP endpoints
- Bcrypt password hashing with password history
- Helmet security headers and strict CORS allowlists
- Paystack webhook signature verification
- Input validation and SQL injection protection via Prisma
- Sentry error monitoring with cookies stripped from reports
Organizational compliance (e.g. HIPAA, SOC 2) depends on your deployment, policies, and BAAs with infrastructure providers. Contact us for enterprise security documentation.