Authentication
- Passwords are hashed rather than stored in plain text.
- Mobile access tokens are short-lived.
- Refresh tokens are rotated and can be revoked.
- Authenticated API routes enforce user identity before returning private data.
Security practices
Security at Carebow
This page describes controls implemented in the application. It is deliberately not a certification statement and does not claim HIPAA, SOC 2, ISO 27001, or another formal compliance status unless such an assessment is completed and independently verifiable.
Infrastructure controls such as host hardening, backup recovery, production scheduler execution, and external compliance audits must be verified operationally; source code alone is not proof that those controls are running correctly in production.
Payment integrity
- Razorpay signatures are verified before direct payment confirmation.
- Payment amounts originate from server-side pricing decisions.
- Pending payment orders are re-checked instead of silently creating duplicate retries.
- Idempotent replay recovery repairs a matching pending payment without rewriting failed or refunded payments.
Private storage
- Application file storage is configured to remain private.
- CI includes a guard against reintroducing code that makes the storage bucket public.
- Health-record upload is not advertised in the mobile launch UI until a durable backend path exists.
Patient-data boundaries
- Family profiles are mapped to explicit backend profile IDs.
- Clinical vitals fail closed when the selected person is not reconciled to a backend profile.
- Profile updates do not invent dates of birth, severity, medication frequency, or other clinical facts.
Monitoring minimization
- Default PII collection is disabled in the mobile Sentry configuration.
- Monitoring user context is limited to an opaque internal ID.
- Request bodies, query strings, cookies, authorization headers, arbitrary extras, and breadcrumb data are stripped before Sentry events leave the device.
Safety operations
- SOS events are recorded before the API acknowledges acceptance.
- Safety dispatch work is retryable through the server dispatcher.
- The public health endpoint exposes dispatcher heartbeat status so an inactive scheduler can be detected.
Questions or a security report?
Contact Carebow with security questions or suspected vulnerabilities. We would rather document a limitation accurately than hide it behind a badge.