Security at Indilum

Plain-English summary

Indilum stores family medical records — lab PDFs, measurements, and notes. We take that seriously. Everything we store is encrypted, access is restricted, and you can export or delete your data any time from account settings. We are not yet HIPAA certified; if you are a healthcare provider looking to store patient PHI on our behalf, don't do that yet — we'll contact you when we are.

What we encrypt

• In transit: TLS 1.2+ on every connection. HSTS is enabled; plain-HTTP requests are redirected.
• At rest: Database volumes are AES-256 encrypted at the provider level. Uploaded files (lab PDFs, images) are stored in object storage with server-side encryption (SSE-S3).
• Passwords: Hashed with bcrypt. We never see or store your plaintext password.
• Auth tokens: Stored in HttpOnly, Secure, SameSite=Lax cookies — not accessible to JavaScript, not sent cross-site.

Who can access your data

• You and the family members you invite. That's it by default.
• Doctors you explicitly share with, via a revocable share link scoped to one child's records. Every doctor view is logged.
• Indilum staff: limited production database access restricted to on-call engineers, protected by 2FA, and used only for debugging when you ask us to. All access is logged.

Subprocessors

We use the following third parties. Each one is covered in our Privacy Policy.

• Hosting: our cloud provider (compute, managed PostgreSQL, Redis).
• Object storage: Cloudflare R2 for uploaded files.
• OCR: Google Cloud Vision to read text from lab PDFs.
• Structured extraction: Anthropic Claude to convert OCR text into structured health metrics. Requests are not used for model training.
• Email delivery: Resend for transactional email (verification, invites, notifications). We do not include health data in emails.
• Error tracking: Sentry. Personally identifiable and health-related fields are scrubbed before events leave our servers.

Data retention

• Uploaded files (PDFs, images) are deleted from object storage 30 days after successful extraction unless you mark them to keep. The structured metrics extracted from them remain in your account.
• Account deletion cascades: members, children, uploads, metrics, journal entries, and sharing grants are removed within 7 days. Encrypted backups roll off within 30 days.
• Audit logs are retained for 1 year for security investigation purposes, then deleted.

What we don't do yet

We want to be straight with you. As of this writing, Indilum has not completed:

• HIPAA certification or signed BAAs with all subprocessors.
• SOC 2 Type II audit.
• Third-party penetration testing.
• End-to-end (client-side) encryption of stored records.

If you need any of these for your use case, we are not the right tool for you yet. These are on our roadmap.

Your controls

• Export: download all your family's data as a ZIP from Settings → Account → Export my data.
• Delete: permanently delete your account and all family data from Settings → Account → Delete my account.
• Revoke shares: any doctor share link can be revoked instantly from the child's record.
• Two-factor authentication: coming soon. If you'd like early access, let us know.

Reporting a vulnerability

If you believe you've found a security issue, please email security@indilum.health. We'll acknowledge within 2 business days and keep you updated until it's resolved. We don't run a paid bug bounty yet, but we credit reporters (with permission) on this page.

We ask that you don't access, modify, or destroy other users' data during testing, don't run automated scanners against production, and give us a reasonable window to fix issues before public disclosure.

Incident response

If we detect or are notified of a breach affecting your data, we will notify affected users by email within 72 hours of confirmation, and post a public incident report describing what happened, what data was involved, and what we've changed to prevent a recurrence.