Security
What we do to protect your data, and what we do not have yet. Updated October 2026.
Protection in place today
- Connections to Somie Health use HTTPS, so what you send is encrypted on its way to us.
- Your data is stored with Supabase (European Union, Paris), which encrypts stored data by default.
- Voice and video calls are encrypted and go straight between your phones. If the networks block a direct path, the call goes through a Cloudflare relay and stays encrypted. If a call still does not connect, chat works.
- Our database rules limit who can read what. Only you and the provider of a visit can read its chat, summary and prescriptions. Admins cannot read visit chats from the app.
- Providers, pharmacies, labs and hospitals are checked by our team before they are marked Verified. See how we verify.
How we look after the app
- Secret keys are kept on the server, not in the website code, and a scanner checks every change for leaked secrets.
- We get automatic alerts and suggested updates when security fixes come out for the software parts we use, and we install them after checking.
- The site blocks many common web attacks (for example with a Content Security Policy).
- We watch whether the site is up and are alerted if it goes down.
What we do not have yet
- An independent security audit. Somie Health is new and has not had one.
- A formal certification or compliance claim such as HIPAA, GDPR or ISO 27001. We do not claim any.
- Multi-step login built into Somie Health for staff and admins (the owner's accounts at Google, GitHub and Vercel do use 2-step verification).
- Our own backups and a tested recovery plan, beyond what our hosting providers do by default.
- Detailed audit logs of who viewed what.
Found a security problem? Please tell us on the Contact page.