Security

• Authentication: OAuth 2.1 with PKCE and dynamic client registration. Access tokens expire after one hour. Each organization signs in with its own code, and only a salted hash of the code is stored.
• Isolation: every record is partitioned by organization, and no tool accepts an organization identifier as input.
• Integrity: audit records are hash-chained. Evidence exports are signed with a per-organization Ed25519 key and can be verified independently.
• Data minimization: patient identifiers are rejected in audit records, and evidence exports carry keyed commitments instead of names or content.
• Hosting: Cloudflare Workers, D1 and KV, with TLS in transit and provider encryption at rest.
• Reporting a vulnerability: email will@skovos.ai with "Security" in the subject. We aim to respond within two business days.