Security

Data Encryption

Polaris is designed to use TLS for network transport. Application-level AES-GCM protects selected caches and secrets; health records and other stored data rely on the configured storage provider's protections unless a deployment adds application-level envelope encryption.

Deployment operators must validate key management, storage encryption, access policy, backup, retention, and rotation settings before handling sensitive data.

Authentication & Access Control

Polaris uses explicit header-based authentication to verify every request. We support secure sign-in methods including email/password and Google OAuth.

Role-based access controls ensure that only authorized users can access specific data. You control who can view or manage your health information through granular permission settings.

Infrastructure Security

Our platform runs on Cloudflare's global edge network, providing enterprise-grade security, DDoS protection, and high availability. Data is processed in secure, isolated environments.

We employ strict network security policies, regular security audits, and continuous monitoring to detect and respond to potential threats.

Audit Logging

Polaris records audit events for supported security-sensitive and clinical actions. Coverage varies by workflow and must be validated; we do not claim that every read is currently captured.

Available audit history supports investigation and accountability, subject to configured retention and access controls.

Compliance & Standards

Polaris includes controls that may support regulated deployments, but the software and infrastructure do not by themselves establish HIPAA, GDPR, or PDPA compliance.

Each operator must complete jurisdiction-specific legal, security, contractual, and configuration review before processing regulated health data.

Applicable privacy laws may include HIPAA, GDPR, and Singapore's PDPA, depending on the operator, users, purpose, and location.

Secure Development

Our development team follows secure coding practices, including regular code reviews, automated security testing, and vulnerability scanning.

We use timing-safe comparison for sensitive operations and implement protections against common web vulnerabilities (OWASP Top 10).

Incident Response

We maintain an incident response plan to quickly address any security events. In the unlikely event of a data breach, we will notify affected users as required by applicable law.

If you discover a security vulnerability, please report it to security@polaris.dpath.ai.