Skip to main content

Legal & policies

Security overview

Last updated: 18 July 2026.

This page is maintained by BranchX Limited to answer common security and privacy questions about MySymplyApp. It describes controls currently enabled in the app. It is not an independent certification.

Authentication

  • Email + password sign-in with mandatory email confirmation.
  • Passwords are checked against the HaveIBeenPwned breach list.
  • Google sign-in supported. Sessions are refreshable and can be revoked on all devices from Account & Privacy.
  • Sensitive actions (data export, account deletion) require a fresh password check or a very recent single sign-on.

Sessions and automatic sign-out

  • Optional two-step sign-in with an authenticator app, plus one-time recovery codes. Recovery codes give a narrow, time-limited fallback for 12 hours; they are stored only as hashes and can be revoked.
  • You are signed out after 30 minutes without activity, with a clear two-minute warning first. You are always signed out 12 hours after signing in.
  • We will never sign you out in the middle of a recording, an upload or an unsaved entry. The countdown waits until your work is finished.
  • Signing out — including an automatic sign-out — immediately revokes the refresh token for that session, so it cannot be renewed. Honest limitation: an access token that has already been issued can remain usable until it expires (up to one hour). “Sign out on all devices” behaves the same way.
  • Session checks are made on the server against your signed-in account. We do not record your IP address or fingerprint your device to do this.

Access control

  • Row-level security in the database means each request only sees rows scoped to the signed-in user or an explicitly granted care circle relationship.
  • Storage buckets are private; files are served through short-lived signed URLs.
  • The service-role key is only used for verified webhooks and admin maintenance and is never exposed to the browser.

Encryption

  • TLS in transit for every connection.
  • At-rest encryption for database and object storage (provider-managed).
  • Share tokens are hashed (SHA-256) before storage.

Abuse prevention

  • Per-user rate limits on voice uploads, transcription, care invitations, data exports, and account deletion attempts.
  • Signed-URL access to share links is logged and rate-limited.
  • Uploaded files are verified against known file signatures before being moved into permanent storage.

Monitoring and logging

  • Server errors are logged to structured server output. When a Sentry DSN is configured for the deployment, errors also stream to Sentry with URLs scrubbed of health content — this integration is optional and disabled by default (see the sub-processors page).
  • Audit events record who did what, when, for security-relevant actions such as consent, sharing, and deletion.

Backups and continuity

  • Automated point-in-time database backups managed by our infrastructure provider.
  • Bucket versioning is not enabled for user files — deleted files are gone; the in-app 30-day grace period is where users can recover from accidental deletion.

Reporting a vulnerability

Please email info@branchx.ie with a description and steps to reproduce. We aim to acknowledge within two business days. We do not run a paid bug bounty at this time.