Security at MedHook

All adapter credentials (EHR connection strings, API keys, SFTP passwords) are encrypted using AES-256-GCM before being stored in PostgreSQL.

Key derivation uses PBKDF2 with 100,000 iterations. Each credential is encrypted with a unique salt and IV. The master encryption key is supplied via environment variable and never stored in the database.

The MedHook Engine uses JWT Bearer tokens with a 2-hour expiry. Tokens are signed with a secret key supplied at deployment time.

medhook.dev sign-in always uses two factors: a password (hashed with scrypt) plus a single-use 6-digit code emailed to you, or a Google Workspace account governed by your organization’s 2-Step Verification policy. TOTP authenticator apps can be added as a further factor. Sessions use secure, HTTP-only cookies. License keys are stored only as SHA-256 hashes — the plaintext is never retained.

Every CRUD operation on workflows, adapter profiles, mappings, and license keys is written to an immutable audit log in PostgreSQL with actor identity, timestamp, and change details.

Audit records are retained for six years by default (AUDIT_LOG_RETENTION_DAYS=2190), matching the HIPAA documentation retention period. Customers can configure retention and export to their SIEM.

The MedHook Engine runs entirely within your infrastructure. For self-hosted engines, PHI stays in your cloud and integration payloads are not sent to medhook.dev. Where our engineers have forward-deployed and support access to your environment, that access is governed by the Business Associate Agreement (BAA) we sign with you before any PHI is processed.

The engine is deployed via Docker Compose or Terraform on AWS, Azure, or GCP. You control network boundaries, VPC configuration, and storage policies.

Role-Based Access Control (RBAC) is enforced at both the API and middleware layers. Admin-only endpoints require verified role claims in both the JWT and the database.

Custom JavaScript transforms run in isolated-vm sandboxes with 128 MB memory limits and 5-second execution timeouts, preventing runaway or malicious code.

The Generic REST adapter includes SSRF protection that blocks requests to private IP ranges (RFC 1918), loopback addresses, and link-local addresses.

Rate limiting is applied to authentication, license validation, and AI mapping endpoints. Content Security Policy headers are enforced on all medhook.dev responses.