Security You Can Verify
LeafNote is built on a Zero-Trust security architecture designed specifically for clinical healthcare data. Here's exactly how we protect your patients.
1. How We Protect Your Patients
PII Scrubbing & Encryption
Client-Side PII Scrubbing
Supported formats for context-labeled names, SSNs, phone numbers, emails, dates, and addresses are redacted in your browser and reviewed before submission. Automated detection is not a complete de-identification guarantee.
AES-256-GCM Encryption
All clinical text is encrypted at the application level using AES-256-GCM before database storage. Even if the database were compromised, the data is unreadable without the encryption key.
2. How We Support Clinical Review
Anti-Hallucination Guardrails
Anti-Hallucination Guardrails
AI temperature is locked at 0.0 for maximum determinism. The system prompt strictly forbids the AI from inventing symptoms, diagnoses, or patient history not present in your notes.
3. Security Readiness
Implemented safeguards and deployment prerequisites
Row-Level Security Isolation
PostgreSQL policies scope authenticated reads and permitted profile updates to the current user. Billing, secret, and audit mutations remain server-only.
No Application Logging of Clinical Text
Clinical text is processed in application memory without application logging or caching. AI-provider retention is governed separately by the active commercial agreement and configuration.
HIPAA Technical Safeguards
Encryption at Rest
AES-256-GCM application-level encryption
Encryption in Transit
HTTPS browser enforcement via HSTS; edge TLS policy verified at deployment
Access Controls
Row-Level Security with per-user isolation
Audit Logging
Append-only server-written events for implemented sensitive flows
Session Management
15-minute idle auto-logout
Data Residency
Must be verified in the production provider configuration
Available Security and Lifecycle Controls
These controls are implemented in the application. Production use still depends on the deployment and provider requirements described above.
- Complete account portability — download a protected JSON archive of your own account data, recoverable clinical records, and revision history, or export active notes as CSV
- Recoverable account deletion — password-verified scheduling includes a 30-day recovery window, subscription and ownership checks, and a service-only due-account purge
- Server-encrypted BYOK — add, rotate, or remove an Anthropic key without returning the stored credential to the browser; corrupt key envelopes fail closed
- Manage Solo or Group billing — eligible Stripe customers use hosted checkout, portal, and subscription-update confirmation flows from Settings