embraceHow Embrace keeps your family's records safe
Health records are personal. Here is what protects yours, checked automatically every week.
Only your family sees your records
- Every part of the database checks who is asking before it answers, and each family can reach only its own records.
- Before any change goes live, more than 300 automatic tests try to reach another family's records. A change that fails is stopped.
- You choose who sees each person, and an entry marked private is seen only by you and the person it is about.
Your records are locked
- Every connection to Embrace is encrypted with current standards. Older, weaker versions are turned off.
- Your records are stored encrypted.
- Photos and documents are locked with our own key before they are stored. Location and camera details are removed from photos, and author names are removed from documents.
Signing in
- There is no password to steal. You sign in with a code sent to your email that works once and expires in 10 minutes.
- You can add Face ID or Touch ID with a passkey.
- Repeated tries are slowed down and then blocked.
Workplace plans
- A company sees only the names on its list. It never sees whether someone uses Embrace, when, or anything they record.
Backups and checks
- Everything is backed up every night, encrypted, and we test bringing a backup back.
- An automated check-up runs every week and flags anything that needs attention.
What we never do
- We never sell your information or show ads.
- Card payments are handled by Stripe. We never see or store your card number.
- Your records stay yours. You can download all of them, or delete your account, at any time.
Companies we rely on
Embrace runs on Supabase (database), Cloudflare (hosting), Stripe (payments), Resend (email) and Apple (the iPhone app). Each publishes its own security certifications.
Technical details
For IT and security teams reviewing Embrace.
Connections
- HTTPS only, with TLS 1.2 or newer. TLS 1.0 and 1.1 are refused.
- HTTP Strict Transport Security for two years, including every subdomain.
- A strict Content Security Policy, no framing by other sites (X-Frame-Options DENY), nosniff and a strict referrer policy. Camera, microphone and location are off except where the app needs the camera.
Stored data
- The database is PostgreSQL, encrypted at rest with AES-256.
- Photos and documents are encrypted with AES-256-GCM using a key held only by our server, separate from the stored files. The file store is private and cannot be reached from a browser. Every file passes through our server, which checks permission first.
- Photos: location and camera details (EXIF and GPS) are removed, Live Photos are saved as still images, and images are resized.
- PDFs: the author, title, creator, XMP metadata and comment authors are removed.
- Word and Excel files: the author, company, dates, saved folder paths and the names on comments and tracked changes are removed.
- Files with macros, password-protected files and old Office formats are refused. The file type is checked from its contents, not its name.
Access control
- Row-level security on every table. Each request is checked against the family and the person it belongs to.
- Someone who is not signed in can reach no records and no functions.
- Private entries are hidden from everyone except the author and the person the entry is about.
- More than 300 automated tests, including attempts to reach another family's records, run before every release. A failing test stops the release.
Sign-in
- No passwords. A 6-digit one-time code by email, valid for 10 minutes, with limits on sending and checking codes.
- Optional passkeys (WebAuthn), such as Face ID or Touch ID.
The service
- Rate limits on every request, tighter for sending, paying, exporting and deleting.
- Error messages reveal nothing about how the system is built.
- Our email is signed and protected against forgery (SPF, DKIM and DMARC), and a CAA record limits which authorities can issue our certificates.
Backups and records
- Nightly encrypted backups of the database and files, with the restore tested.
- Deleted records are removed for good after 30 days. Website visit records are removed after 400 days.
Ongoing checks
- An automated weekly security review of the database rules (on the live system and in the code), secrets in the code and its history, known flaws in the libraries Embrace uses, browser protections and certificates, email signing and backups. Any problem goes straight to the founder.
Questions about security, or a problem to report? Write to hello@embracehealthapp.com.