How we protect records
- Server-side authorisation on every sensitive operation
- Role-based access for patients, doctors, facility staff and administrators
- Encryption in transit and at rest
- Private document storage with time-limited links
- Secrets kept only in secure server storage
- Audit logs with restricted modification access
QR safety
The QR code holds only an opaque, expiring reference. Scanning it shows a sign-in or consent screen — never records.
Testing and audits
We are preparing for the security audit that ABDM requires before production. No audit has been completed yet.
Report a vulnerability
Email security@nevikacura.com. Please don't include patient information in your report.
