Built for a clinical trust boundary from the first line of code.
RepCertify handles sensitive representative data, so the platform is designed around isolation, least privilege, and evidence you can hand to an auditor. This page summarizes how — in plain language, not certification badges.
Tenant isolation & access control
- Every query and mutation authorizes the facility and location before it looks up a record — access is checked first, data second.
- Tenant boundaries are enforced at the database with composite foreign keys, so a cross-tenant reference simply cannot be written.
- Roles are scoped and least-privilege: a billing operator can't open credential documents, and a vendor admin can't see unrelated facilities.
Data protection
- Sensitive representative PII (identity, contact, phone) is encrypted, and lookups use keyed digests rather than raw values.
- Files live in private storage. Browser uploads use short-lived tokens scoped to a specific actor, tenant, file type, and size.
- Provider secrets are server-only and never exposed to the browser.
Audit & accountability
- Audit history is append-only at the database layer — records can be added but never quietly changed or deleted.
- The business change and its audit record are written in the same transaction, so history can't drift from what happened.
- Facilities can export audit-ready history covering check-ins, claims, screening, and lunches.
Screening integrity
- Exclusion screening fails closed: a rate limit, stale extract, or source error can never produce a false “clear.”
- Every candidate — including an exact name match — is reviewed by a person. Nothing is auto-denied or auto-cleared on an ambiguous match.
- Each screening result records which source and dataset version produced it, so any past decision can be reconstructed.
The safest data is the data we never hold.
Some risk is best avoided entirely. RepCertify deliberately does not collect several categories of sensitive information.
- Social Security Numbers or Taxpayer Identification Numbers — not in a column, not in a log.
- Criminal background reports — RepCertify stores only a company's signed attestation, never the report itself.
- Patient information — there are no patient records in the product, so no PHI passes through the platform.
Uploaded files stay quarantined until a malware scan passes — nothing unscanned ever becomes downloadable.
A deliberately small vendor footprint.
RepCertify runs on a narrow, well-known set of providers. We share only the data each one needs to do its job. This is the current list; a data-processing addendum is available on request.
| Provider | Purpose | Data shared |
|---|---|---|
| Vercel | Application hosting & delivery | Application traffic; encrypted file storage (Blob) |
| Neon (via Vercel Marketplace) | Managed Postgres database | Application records (PII fields encrypted at rest) |
| Clerk | Authentication (identity only) | Sign-in identity; RepCertify owns roles and access |
| Stripe | Payment processing | Billing details for paid subscriptions |
| Twilio | SMS (lunch confirmations) | Phone number and message content for opted-in reps |
| Email provider | Transactional & inbound email | Email address and message content |
| Upstash | Rate limiting & abuse control | Ephemeral request metadata |
Have a security or vendor-review question? Email support@repcertify.com.
Reviewing RepCertify for your practice?
We're happy to walk your security or compliance team through how representative data is handled and answer a vendor questionnaire.