How MedVault protects your family's medical records

• Everything you send to MedVault travels over HTTPS (TLS). We do not offer an unencrypted endpoint.
• Uploaded documents are stored in a private storage bucket that is not publicly listable or browsable. Files at rest are encrypted by our hosting provider's storage layer.
• Database records are stored in a managed Postgres database with encryption at rest provided by the hosting platform.
• MedVault does not use end-to-end encryption: our servers process your documents in order to read, extract and explain them. Anyone with access to your account can therefore see your records, and so can our infrastructure in the narrow paths described below.

• Every table that holds your data is protected by row-level security in the database. Queries are executed as your signed-in user, so a request can only ever return rows belonging to your household.
• Documents are never served from a public URL. Viewing a file issues a signed link that expires in about 30 seconds.
• Exports and single-file downloads use one-time links that expire in roughly 90 seconds and stop working after the first fetch.
• Every PDF that leaves the vault is watermarked with a confidential mark plus who exported it and when.
• Optional two-factor authentication (TOTP) can be turned on in Settings, and sensitive actions such as exporting or sharing can require a fresh second-factor check.
• Signed-in devices are listed in Settings and can be revoked remotely. New sign-ins can notify you.

• Document views, exports and shares are written to an append-only activity log that the app itself cannot edit or delete.
• Consent changes — such as sharing a preference with another Atriverse app — are recorded as separate, timestamped consent events you can review.
• You can read your own activity from the Trust activity view inside the app.

• We keep your documents and the values extracted from them for as long as your account exists, because the whole point of the vault is long-term history.
• Short-lived download tickets and signed URLs are discarded once used or expired.
• Security and access-log entries are retained so that the audit trail stays meaningful over time.
• We do not sell your data, and we do not use your medical records to advertise to you.

• You can delete an individual document from the Vault at any time. This removes the stored file and the values extracted from it.
• You can remove a family member profile and the records attached to it from household settings.
• To delete your entire account and household, email security@atriverse.com from your account address and ask for deletion. We remove your stored files and records; backups age out on the hosting provider's normal cycle.
• Append-only security log entries may be retained after deletion in a de-identified form so the audit trail is not rewritten.

MedVault is built on a small number of providers. These are the ones that can process data on our behalf:

• Lovable Cloud (Supabase infrastructure)

  Hosts our database, authentication, and the private storage bucket holding your uploaded documents.

• Anthropic (Claude)

  Reads uploaded reports to extract values and answer your questions. Document text and images are sent to the model to produce a result.

• Cloudflare

  Serves the app and its server functions at the network edge.

• Atriverse Core

  Optional single sign-on and cross-app sharing. Data only moves to another Atriverse app after you explicitly consent, and each consent is logged.

We update this list when a provider is added or removed. Ask us at security@atriverse.com if you need the current list in writing.