Data Security

All patient and practice data, including scheduling and appointment data, is hosted in Frankfurt, Germany, within the EU, via Supabase, with no separate scheduling infrastructure or vendor. Data residency for Monoy's AI features (Anthropic Claude API) remains on Anthropic's US infrastructure - covered by a Data Processing Addendum with Standard Contractual Clauses for the transfer itself, but not EU-based processing, see our Privacy Policy for detail.

• All data is encrypted at rest by default (Supabase's standard encryption).
• All traffic between your browser, the patient portal, and Monoy's servers is encrypted in transit (HTTPS).
• Documents (lab results, referral letters, prescriptions) are never publicly accessible. Every document is served through a signed URL with a 15-minute expiry, generated fresh for each access request.

• Every table holding patient or practice data is scoped to a specific practitioner via Row Level Security (RLS), enforced at the database level, not just in the application. This means a misconfigured page or API route cannot leak another practice's data, the database itself refuses the query.
• An administrator seat's access is scoped identically to the practitioner's own, and can be revoked independently at any time without affecting the practitioner's own account.
• Final clinical sign-off, review and sending of AI-generated instructions, is restricted to the practitioner role at the database level, not just hidden in the interface.

• Practitioners and administrator seats log in via phone-based one-time passwords (OTP), not static passwords.
• Patients never create an account or password. Access to the patient portal is via a unique, single-purpose magic link sent by SMS, each one a distinct token with its own expiry.
• Record share links (for sending a patient's file to another doctor) expire automatically after 30 days, and every access is logged with a timestamp for audit purposes.

• Supabase - database, auth, file storage. Data Processing Agreement signed.
• Stripe - subscription billing. Data Processing Agreement incorporated into our Services Agreement.
• Twilio - SMS and (from V2) WhatsApp messaging. Twilio's Data Processing Addendum, incorporated by reference into their Terms of Service, applies to this processing.
• Anthropic - AI processing (briefs, draft instructions). Covered by Anthropic's Data Processing Addendum, incorporated into Anthropic's Commercial Terms of Service and including Standard Contractual Clauses for the EU-to-US transfer. Processing occurs on Anthropic's US infrastructure; true EU data residency isn't offered for direct API access, and remains a longer-term infrastructure question rather than a live compliance gap.

Being direct about this rather than glossing over it, since an inaccurate security page is worse than a shorter, honest one:

• A formal, tested incident response process. This needs to exist and be exercised before it's described publicly as a capability.
• Backup and disaster recovery procedures, and their tested recovery time, need to be defined and verified, not assumed from Supabase's own infrastructure guarantees alone.
• A responsible disclosure process for security researchers to report vulnerabilities.
• Independent security testing (penetration testing or third-party audit) has not yet been performed. This is planned as the practitioner base grows.

In the event of a data breach affecting personal data, Ghostudio Limited will notify the Cyprus Commissioner for Personal Data Protection without undue delay, and where feasible within 72 hours of becoming aware of the breach, consistent with GDPR requirements.

Two internal security review checkpoints are built into Monoy's development process. The first ran on August 12, 2026, after Row Level Security shipped and before authentication was layered on top of it - it found and fixed 4 confirmed vulnerabilities before any real patient data existed in the system. The second is scheduled before any real, non-test patient data is imported, and will be marked complete here once run.

Security questions or vulnerability reports can be sent directly to guillaume@monoy.doctor.