Security & compliance
Built for healthcare trust
Professional documentation of our authentication protocols, encryption standards, and immutable audit architecture.
MDID is built on a zero-trust security model. Raw documents are never persisted in the application database — all credential files are stored in encrypted AWS S3 and accessed exclusively through signed URLs. Every interaction is logged in an immutable audit trail.
Authentication
- Auth0-powered identity with mandatory MFA
- Google SSO support for enterprise deployments
- 30-minute session timeout with automatic logout
- Role-based access control for physicians and delegates
Encryption
- AES-256 encryption at rest in AWS S3
- TLS 1.2+ encryption in transit for all API traffic
- Documents never stored in the application database
- Signed URLs with time-limited access for downloads
Audit & compliance
- Append-only, immutable audit log for all vault actions
- CSV export for compliance reviews and credentialing audits
- Delegate access tracking with instant revocation
- HIPAA-aware architecture designed for healthcare workflows
HIPAA-aware architecture
Designed for healthcare compliance with encryption at rest and in transit.
MFA & session control
Mandatory multi-factor authentication with 30-minute session timeout enforcement.
Signed URL access
Documents stored in encrypted S3—accessed only through signed URLs, never in the database.
Immutable audit logs
Every action is recorded in an append-only audit system for full traceability.