Security architecture

• Encrypted database. All clinical records live in a SQLCipher AES-256 encrypted SQLite database. Nothing is written to disk in the clear — including the tamper-evident audit log, which lives inside the same encrypted database.
• Hardware-backed keys.The database key is generated on the device and never leaves it. On iOS it is held in the Keychain; on Android, the Keystore; on desktop, the operating system’s secure storage (see supported configurations below).
• Sandboxed media.Photos and videos are written only to the app’s private sandbox — never the camera roll — and EXIF metadata, including GPS location, is stripped before save.

• Biometric unlock with PIN fallback. The lock is enforced at the navigation layer: patient screens cannot render while the app is locked, and cancelling the biometric prompt leaves the app locked.
• The app locks on backgrounding and after idle time.
• On desktop, the same app-lock model applies; shared workstations should additionally use per-user OS accounts (see supported configurations).

Every record create, open, edit, export, and delete is written to a hash-chained audit log: each entry stores the previous entry’s hash (prev_hash → row_hash), so any alteration of history breaks the chain and is detectable. The log is stored on-device inside the encrypted database — it is evidence for your organization, not telemetry for us.

The only networked functions are licensing (activation, seat management) and the admin Portal. They handle license codes, device fingerprints, admin accounts, and billing references — never clinical content. Portal traffic is TLS-encrypted; passwords are stored as salted hashes; payment card data is handled by Stripe and never stored by us; each organization can access only its own licensing data.

The desktop app maintains encryption parity with mobile — with one honest caveat about where the key is stored:

• macOS — supported. Database key protected by the macOS Keychain.
• Windows — supported. Database key protected by Windows DPAPI.
• Linux — not supported without an OS keyring. On machines lacking OS-level secure storage, key protection strength varies, so the app refuses to fall back to storing the key in plaintext rather than silently weakening its guarantees.

On shared workstations, the operating system account is part of the security boundary: use per-user OS accounts and lock the OS session. Organizational device hygiene is the customer’s responsibility under our enterprise terms.

• Mobile builds are distributed through the Apple App Store and Google Play review and signing pipelines.
• Desktop builds are code-signed (Apple Developer ID with notarization on macOS; Authenticode on Windows), and auto-updates are delivered signed.
• Clinical reference values shown in the app cite their source guideline and date in the interface, and clinical calculations are covered by automated tests with expected values taken from the source guidelines.

We welcome good-faith security research. Report vulnerabilities to contact@unchartedmed.com with “Security Report” in the subject. Include steps to reproduce, affected platform and version, and impact. Please use test data only — never patient data — in proof-of-concept material, give us a reasonable window to fix before public disclosure, and don’t access data that isn’t yours. We will acknowledge reports promptly and keep you informed through the fix.

Security questionnaires, enterprise security reviews, or anything this page doesn’t answer: contact@unchartedmed.com.