How your data is protected
A plain-language look at encryption, account isolation, payment security, and access controls. For the full legal terms, see our Privacy Policy.
Encryption in transit & at rest
Every connection to MsgHealth — the dashboard, your public booking page, your digital card, API calls — is encrypted in transit over TLS. Your data at rest is stored with Supabase, our database provider, which encrypts data at rest by default.
Some fields need a stronger guarantee than database-level encryption alone: worker Social Security and Tax ID numbers used for 1099/W-2 filing in the Accountant tools are additionally encrypted with AES-256-GCM before they're ever written to the database, using a key that's separate from database access itself. That means even a raw database read can't recover those values without the encryption key.
- TLS encrypts every connection to MsgHealth
- Data at rest is encrypted by default via our database provider, Supabase
- Worker SSNs/TINs get an extra layer: AES-256-GCM field encryption with a separate key
Account & data isolation
MsgHealth is multi-tenant — many businesses share the same underlying infrastructure, and keeping each account's data walled off from every other account is foundational, not an afterthought. Every table holding your clients, bookings, messages, and other business data enforces Row-Level Security (RLS) at the database level, tied to your account's own ID. That means the isolation is enforced by the database itself on every single query, not just by application code remembering to filter correctly.
- Multi-tenant by design, with isolation enforced at the database layer
- Row-Level Security (RLS) scopes every query to your own account automatically
- Isolation doesn't depend on application code getting a filter right every time
Payment & webhook security
We never store your clients' full card numbers — payments run through Stripe, a PCI-compliant payment processor, and MsgHealth only ever sees a tokenized reference to a payment method, never the raw card number.
Every webhook MsgHealth receives from a third party — Stripe payment events, Twilio/SignalWire call and SMS events, email delivery events — is verified using that provider's cryptographic signature before it's trusted. A request claiming to be from Stripe or Twilio that doesn't carry a valid signature is rejected outright.
- Card numbers are never stored by MsgHealth — Stripe (PCI-compliant) handles that
- Every third-party webhook is signature-verified before it's trusted
- Unsigned or invalid webhook requests are rejected
Access control & monitoring
Sign-in uses email/password or phone-based one-time passcodes through Supabase Auth. Login and OTP endpoints are rate-limited to slow down automated guessing, and OTP verification specifically fails closed under unusual conditions rather than silently allowing extra attempts through.
Enterprise accounts get Audit Logs, which record sign-ins, settings changes, data exports, and team/role changes so you have a record of who did what and when. We don't currently offer account-level two-factor authentication (2FA) beyond phone OTP for verification flows — full 2FA for every sign-in is on our roadmap.
- Sign-in via Supabase Auth (email/password or phone OTP)
- Login and OTP endpoints are rate-limited against automated guessing
- Audit Logs (Enterprise) record sign-ins, settings changes, exports, and team changes
- Full account 2FA on every sign-in is on the roadmap, not available yet
Have a security question we didn't cover?
Reach out below and our team will get back to you directly.
Contact supportSecurity questions
Do you store my clients' credit card numbers?
No — payments are processed by Stripe, a PCI-compliant payment processor. MsgHealth only ever receives a tokenized reference, never the raw card number.
Can another MsgHealth customer see my data?
No — Row-Level Security is enforced at the database level on every table holding your business data, scoped to your account. This isolation is enforced by the database itself, not just by application logic.
Is my data encrypted?
Yes — all traffic to MsgHealth is encrypted in transit over TLS, and data at rest is encrypted by our database provider, Supabase. Especially sensitive fields, like worker SSNs/TINs for tax filing, get an additional layer of AES-256-GCM encryption on top of that.
Do you offer two-factor authentication (2FA)?
Not yet for every sign-in — account access currently uses Supabase Auth with email/password or phone OTP verification. Full account-level 2FA is on our roadmap.
How do you verify that a webhook (like a Stripe payment event) is really from that provider?
Every webhook is checked against that provider's cryptographic signature before MsgHealth trusts it. Requests without a valid signature are rejected.
Can I see a log of who accessed or changed my account?
Yes, on Enterprise plans — Audit Logs record sign-ins, settings changes, data exports, and team/role changes.
Where can I read your full privacy policy?
This article is a plain-language overview of our security practices. For the full legal privacy policy, including data retention and your rights, see our Privacy Policy page.
Still having trouble?
Reach out with an in-depth description of your issue and our team will get back to you within a few hours on business days.