Security

Vaulth AI is a personal health record locker. Your medical data is among the most sensitive information you own, and protecting it is the core of the product — not an afterthought. This page summarises, in plain language, the safeguards we operate. The formal, legally binding version lives in Section 8 of our Privacy Policy.

Compliance posture. Vaulth AI is built to be DPDP-aligned and HIPAA-aligned. We are not certified by any third-party agency under HIPAA, and we do not claim certification. We treat alignment with India’s Digital Personal Data Protection (DPDP) Act, 2023 and with HIPAA’s privacy and security standards as an active, evolving engineering practice.

Encryption

All traffic between your device and Vaulth AI is encrypted in transit over TLS. At rest, third-party connection secrets — the Google Fit OAuth tokens and the Sign in with Apple refresh token, plus cloud infrastructure API keys — are additionally encrypted at the application layer using AES-256.

Signing in & sessions

• Passwords are stored only as a slow, salted hash — never in plain text, and never readable by us.
• Your session lives in a secure cookie that scripts on a web page cannot read.
• Logging out, or changing your password, ends every session on every device straight away.

Where your data lives

Your records are hosted on Google Cloud Platform in the asia-south1 (Mumbai) region. Data residency is maintained within India at rest — your health data does not leave the country in the course of normal storage.

Isolated document processing

When you upload a prescription or lab report, the text is read by our own scanning service, which runs in an isolated environment with no access to the internet. Every file is checked to be the type it claims to be before anything reads it, and nothing from the scanning step is kept once the result is saved to your record.

Protection against abuse

• Limits on sign-in attempts and other sensitive actions, to slow down password guessing and abuse.
• Browser security protections on every page and response.
• Everything sent to our servers is checked before it is used.
• Other websites cannot make requests to Vaulth AI on your behalf.

Access governance

Every time someone other than you reads or changes a record — a caregiver acting for you, a family member viewing something you shared — we check, on that request, who owns the record and exactly what they have been granted. Caregiver permissions, family sharing and account ownership are checked every time, not once at sign-in.

What you can see for yourself:

• For each share link, how many times it has been opened and when it was last opened.
• Each time your emergency card has been viewed.
• A record of your own account activity, included when you export your data from Settings.

Public emergency (ICE) links

The In Case of Emergency card is the one feature that is public by design. When you activate it, it opens from a long, randomly generated link that cannot be guessed, without a login. It always shows your name, date of birth and gender; every other detail appears only if you chose to include it. Every view is logged and access is rate-limited. You can revoke the link instantly from your dashboard, and it stops working at once.

Third-party sub-processors

We rely on a small set of vetted sub-processors (cloud hosting, AI inference, email delivery, messaging, and wearable sync), each under a Data Processing Agreement. The complete list — what each one does and what data it sees — is disclosed in Section 6 of our Privacy Policy. We do not sell, rent, or use your health data for advertising.

Breach response

In the event of a confirmed or suspected breach of personal or health data, we will report to the Data Protection Board of India within 72 hours of detection and notify affected users without undue delay, describing the nature of the breach, the data categories involved, and the remediation steps taken.

Responsible disclosure

If you believe you have found a security vulnerability in Vaulth AI, we want to hear from you. Please report it privately to our Data Protection Officer at rishi@vaulthai.health rather than disclosing it publicly, and give us a reasonable opportunity to investigate and fix the issue before any public disclosure. We aim to acknowledge reports within 24 hours.