PlatformSecurity.

1Encryption

Case files stored on Cloudflare R2 are encrypted at rest with AES-256 GCM. That encryption is part of the storage service. Connections, including file uploads, use TLS.

This covers the files on a case: shade photos, STL scans, and voice notes. A file attached to a case is stored on R2. The case record in the database, including the prescription fields, is not stored as an R2 object and is not field-encrypted by the application.

2Role-based access control

Three access levels: lab technician, clinic admin, and doctor. Each role has per-case configurable permissions. Visibility is restricted by design.

Lab technicians

See only the cases assigned to their lab. They can view files, messages, and Rx data for those cases. They cannot see cases from other labs or other clinics connected to the platform.

Clinic admins

See all cases from their clinic across all doctors and labs. They coordinate workflow, manage deadlines, and route cases. They cannot modify clinical prescriptions.

Doctors

See only their own cases. They cannot see cases from other doctors in the same clinic. They have full control over their clinical data, including the ability to export everything at any time.

This isolation is enforced at the database query level — it is not a UI filter that could be bypassed. A user cannot request data they are not authorized to see, even through the API.

3Access revocation

Any user's access can be revoked instantly. Upon revocation, the user loses visibility into all associated cases and files. Data never resides on the user's device — TrazaLab is a web application with no local data cache.

When a doctor leaves a clinic or a lab technician changes jobs, the account owner revokes their access with one action. The revocation is immediate — there is no propagation delay. The revoked user's past actions remain in the audit log for accountability.

4Audit log

Every action is logged with timestamp, user, action type, and affected resource. Logs are exportable for external audits.

• Case creation
• File uploads
• File downloads
• Message sends
• Rx modifications
• Approvals
• Status changes
• Access grants
• Access revocations

Each entry includes the user ID, IP address, action type, target resource, and UTC timestamp. Audit logs cannot be modified or deleted by any user, including account owners. They are designed to provide an immutable record of all platform activity for compliance and dispute resolution.

5Data residency and infrastructure

Cloudflare R2 stores data across multiple geographic locations with automatic replication. The specific replication strategy is managed by Cloudflare's infrastructure — TrazaLab does not control which data centers receive copies, but all copies are encrypted at rest.

Voice notes processed by OpenAI Whisper API are transmitted over encrypted connections. The audio is used solely for transcription and is not retained by OpenAI for training purposes, per their API data usage policy.

WhatsApp notifications are sent through the official WhatsApp Business API. Message content is limited to notification triggers (case status changes, approval requests) — clinical data and files are never transmitted through WhatsApp.

6Incident response

TrazaLab maintains an incident response protocol for security events. If a data breach or unauthorized access is detected, affected users are notified within 72 hours with details about the scope, impact, and remediation steps taken.

The platform uses Cloudflare's DDoS protection and WAF (Web Application Firewall) to mitigate common attack vectors. Rate limiting is applied to API endpoints to prevent brute-force attempts.

7Compliance approach

TrazaLab is designed to support compliance with data protection regulations such as GDPR and Spain's LOPDGDD, HIPAA in the United States, and Latin American data protection laws. The platform implements technical controls — encryption, access control, audit logging, data export, and access revocation — that align with the security requirements of these frameworks.

8Vulnerability reporting

We take all reports seriously and respond within 48 hours. If a reported vulnerability is confirmed, we will credit the reporter (unless they prefer anonymity) and provide a timeline for remediation.