Security

Our security architecture

ChairLeaf Pro was designed from day one with a privacy-first architecture. The key principle: if we never hold patient data, there is nothing to breach, nothing to govern, and nothing to worry about.

Patient data

ChairLeaf Pro is HIPAA-safe by architecture, not by policy. Here is exactly what happens when you generate a document:

1. You type clinical findings into the generator form in your browser.
2. Your browser sends those inputs to ChairLeaf's secure server-side proxy.
3. The proxy checks your active subscription, then forwards the inputs to the API.
4. The generated document is returned to your browser.
5. The inputs and document are discarded. Nothing is written to any database or log.

No patient names, dates of birth, or identifying information are ever requested or stored by ChairLeaf Pro. Because no Protected Health Information (PHI) is retained, no Business Associate Agreement (BAA) is required.

Account and billing security

• Passwords are not used. Authentication is entirely via single-use magic links sent to your registered email.
• Session tokens are cryptographically random (256-bit), stored as hashed values in the database, and expire on logout.
• Magic link tokens are single-use and expire after 15 minutes. Used tokens are invalidated immediately.
• Rate limiting is applied to login requests to prevent email enumeration and brute-force attempts.
• Payment details are handled entirely by Stripe and never touch ChairLeaf Pro's servers. ChairLeaf Pro stores only a Stripe Customer ID.
• Admin credentials are stored as bcrypt hashes with a cost factor of 12.

Infrastructure security

• All traffic is served over HTTPS. HTTP requests are permanently redirected (301) to HTTPS.
• HTTP Strict Transport Security (HSTS) is enforced with a one-year max-age.
• Security headers are set on all responses: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Directory listing is disabled on the web server.
• Server-side configuration files (config.php) are stored above the web root and are not accessible via any browser request.
• Database credentials, API keys, and Stripe secrets are never hardcoded in any browser-accessible file.
• CSRF tokens are validated on all state-changing form submissions.
• All database queries use prepared statements with parameterised inputs — no SQL injection vectors.
• User inputs are sanitised and validated before use.

Third-party security

Anthropic (Claude API)

Clinical inputs are processed by Anthropic's Claude API to generate documents. Anthropic does not use API inputs to train its models by default. Anthropic's infrastructure is enterprise-grade and compliant with SOC 2 Type II. Anthropic's Privacy Policy →

Stripe

All payment processing is handled by Stripe, which is PCI-DSS Level 1 certified — the highest level of payment security certification. ChairLeaf Pro never stores, transmits, or processes card numbers. Stripe's Security page →

Incident response

In the event of a security incident affecting subscriber account data, we will:

• Notify affected subscribers by email within 72 hours of becoming aware of the incident.
• Describe the nature of the incident, data affected, and steps taken.
• Provide guidance on any steps subscribers should take.

Because no patient data is ever stored, a security incident affecting ChairLeaf Pro's systems cannot result in a breach of patient health information.

Responsible disclosure

If you discover a security vulnerability in ChairLeaf Pro, please report it to us privately before disclosing it publicly. We take all security reports seriously and will respond within 48 hours.