Security overview

Last updated: 18 July 2026.

This page is maintained by BranchX Limited to answer common security and privacy questions about Symply. It describes controls currently enabled in the app. It is not an independent certification.

Authentication

• Email + password sign-in with mandatory email confirmation.
• Passwords are checked against the HaveIBeenPwned breach list.
• Google sign-in supported. Sessions are refreshable and can be revoked on all devices from Account & Privacy.
• Sensitive actions (data export, account deletion) require a fresh password check or a very recent single sign-on.

Access control

• Row-level security in the database means each request only sees rows scoped to the signed-in user or an explicitly granted care circle relationship.
• Storage buckets are private; files are served through short-lived signed URLs.
• The service-role key is only used for verified webhooks and admin maintenance and is never exposed to the browser.

Encryption

• TLS in transit for every connection.
• At-rest encryption for database and object storage (provider-managed).
• Share tokens are hashed (SHA-256) before storage.

Abuse prevention

• Per-user rate limits on voice uploads, transcription, care invitations, data exports, and account deletion attempts.
• Signed-URL access to share links is logged and rate-limited.
• Uploaded files are verified against known file signatures before being moved into permanent storage.

Monitoring and logging

• Server errors are logged to structured server output. When a Sentry DSN is configured for the deployment, errors also stream to Sentry with URLs scrubbed of health content — this integration is optional and disabled by default (see the sub-processors page).
• Audit events record who did what, when, for security-relevant actions such as consent, sharing, and deletion.

Backups and continuity

• Automated point-in-time database backups managed by our infrastructure provider.
• Bucket versioning is not enabled for user files — deleted files are gone; the in-app 30-day grace period is where users can recover from accidental deletion.

Reporting a vulnerability

Please email security@symply.health with a description and steps to reproduce. We aim to acknowledge within two business days. We do not run a paid bug bounty at this time.