Security Architecture
Privacy is not a feature at SEDU — it is the foundation. Our security architecture is designed from the ground up to protect sensitive personal health information and earn user trust at every layer.
Transport & Storage Encryption
All data transmitted to and from SEDU is protected by industry-standard TLS encryption in transit. Cloud databases are hosted in restricted environments with encrypted storage volumes at rest. Clinical communications and sensitive records are restricted behind authenticated session boundaries.
Authentication & Database Infrastructure
User authentication and session tokens are managed via Supabase, a SOC 2 Type II compliant infrastructure provider built on PostgreSQL with Row Level Security (RLS). Core domain entities, consultation records, and marketplace orders are housed in dedicated MongoDB Atlas database clusters protected by strict network isolation and role-based access controls.
Minimal Data Surface
We operate a principle of data minimisation. We collect only what is required for core functionality. No third-party analytics trackers, no advertising pixels, no behavioural profiling. Every data field collected has a defined purpose and retention policy.
Access Controls
Admin access to user data is strictly controlled through authenticated sessions with role-based access control. Session tokens are short-lived and scoped to specific permissions. All admin actions are logged with timestamps and operator identity.
Compliance Standards
Responsible Disclosure Policy
- All security reports are treated with the highest priority. We do not currently operate a public bug bounty program but will formally acknowledge responsible disclosures.
- Contact our security team at: security@seduhealth.com
- Please include detailed reproduction steps and do not exploit vulnerabilities beyond demonstrating the flaw.
- We commit to acknowledging your report within 48 hours, providing a status update within 7 days, and crediting you (with your permission) once the vulnerability has been resolved.
- We ask that you do not publicly disclose vulnerabilities until we have had the opportunity to investigate and remediate the issue.
- SEDU does not currently operate a paid bug bounty programme, but we deeply appreciate responsible disclosure and will recognise significant contributions publicly.