Encrypted contact details
Staff email addresses and phone numbers are encrypted in the application with AES-256-GCM before they reach the database, and looked up through a keyed blind index — so finding someone never requires the plaintext.
Security & privacy
How credentracker protects your staff credential records
credentracker holds workforce data — who is cleared to work, until when, and the documents that prove it. This page describes the safeguards that are actually in place, so your compliance and IT teams can assess them for themselves.
Encryption
Protected in transit, at rest and on the way in
The files your staff upload and the details that identify them are treated as sensitive data, because that is what they are.
Keys kept apart from the data
Encryption keys are stored as encrypted parameters in AWS, separate from the database, and can be rotated while records written under an older key still decrypt.
Private documents
Files sit in private storage with server-side encryption and are opened only through signed links that expire within minutes. There is no public URL to forward by mistake.
Scanned before anyone opens them
Uploads must be PDF, JPG or PNG up to 10 MB and match the file type they claim to be. Each is scanned for malware by AWS GuardDuty; an infected file is deleted and never becomes downloadable.
Infrastructure
Where your data lives
One region, in the United States, on infrastructure defined in code.
| Area | How it works |
|---|---|
| Region | Amazon Web Services, us-east-1 (United States): the application, database, document storage and cache. |
| Database | Managed PostgreSQL (Amazon RDS) in private subnets, encrypted at rest, TLS-only connections and automated backups with point-in-time recovery. |
| Documents | A private Amazon S3 bucket with public access blocked and server-side encryption under an AWS KMS key. |
| In transit | The site and app are served over HTTPS (TLS), with HTTP Strict Transport Security telling browsers never to fall back to plain HTTP. Database connections use TLS too. |
Access control
The rules live on the server, not in the interface
The same checks apply in the browser, on a phone and in an export. Hiding a button has never been a security control.
| Control | How it works |
|---|---|
| Clinic isolation | Every query is scoped to your clinic. A record belonging to another clinic isn't “forbidden” — as far as your request is concerned it doesn't exist. |
| Server-side permissions | Roles are checked by the server on every request, not just hidden in the interface. Managing staff, reading billing and reading the audit log each need their own permission. |
| One-time codes, no passwords | There is no password to leak or reuse. Sign-in codes expire after 10 minutes, attempts are rate-limited, and the response is the same whether or not an account exists. |
| Revocable sessions | “Sign out everywhere” in account settings ends every session — the right move when a phone or laptop goes missing. Suspending a user ends theirs. |
| Support access on the record | If Haven Technologies support needs to open your clinic to fix a problem, access requires a stated reason, expires within an hour and is written to your audit log. |
| Audit log | Sign-ins, document views, exports, credential changes, invitations and settings changes are recorded with who, when and from where. The application only ever adds entries. |
| Browser protections | A per-request Content Security Policy, HTTP-only same-site session cookies, framing disabled, MIME sniffing disabled and a strict referrer policy. |
HIPAA and your obligations
What credentracker is — and isn't — for
Clinics and hospitals rightly ask about HIPAA. Here is the straight answer.
credentracker is built for workforce credential records — licenses, certifications, screenings and the documents behind them. It is not an electronic health record, it is not designed to hold patient health information, and the terms of service do not allow uploading patient information.
We do not claim HIPAA compliance or any security certification on credentracker's behalf, and no software can make an organization compliant on its own. This page describes the safeguards in place so you can assess them against your own policies and obligations. If your organization needs compliance documentation for a vendor review, email support@credentracker.com.
What stays with you
- Your risk assessments, written policies and staff training.
- Deciding who gets access, and reviewing it when people leave or change roles.
- Verifying credentials with the issuing body where your policies require it.
- Keeping patient information out of credentracker.
What we take care of
- Encrypting contact details and storing documents privately with server-side encryption.
- Enforcing permissions on the server and keeping the audit log add-only.
- Scanning every upload and deleting anything infected.
- Keeping the service, its dependencies and its infrastructure maintained.
Your data
Exporting and deleting
Your clinic owns its records, and you can take them with you.
Admins and HR can export the credentials register (PDF, Excel or CSV) and the workforce roster (Excel or CSV) at any time — including while a subscription is past due, when the clinic is read-only but everything stays exportable.
Deleting a credential or a user removes it from every list straight away. Records are soft-deleted rather than destroyed, so the compliance history and audit trail survive an accidental click. Deleting a clinic also releases its members' lookup keys, so the same person can later be invited by another clinic. The privacy notice covers retention in full.
Subprocessors
Who else processes your data, and why
Each provider below is used for a specific purpose.
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, document storage, encryption keys, managed secrets and malware scanning | United States (us-east-1) |
| Stripe | Subscription billing and card processing — card details never reach our servers | United States |
| ZeptoMail (Zoho) | Transactional email: sign-in codes, invitations and reminders | United States |
| Telnyx | Transactional SMS: sign-in codes, invitations and expiration reminders | United States |
| Sentry | Error monitoring, configured to exclude user details, cookies, request bodies and query strings | United States |
| PostHog | Server-side product analytics using opaque IDs — no names, contact details or credential details | United States |
Contact
Security questions and vulnerability reports
Security reviews are part of buying software for a clinic, so we answer them directly.
Send security questionnaires and security questions to security@credentracker.com. If you think you have found a vulnerability, report it to the same address — we confirm receipt and follow up with what we found. Our security.txt lists the same contact.
Bring your credential file under control
Sign up, add your team and see every license and certification in one place — protected the way this page describes.