Security overview
Protection designed around department boundaries
Unitavra uses layered account, authorization, storage, records, and audit controls. This page describes current design and does not claim a third-party certification.
Identity, verification, and sessions
Supabase provides password authentication, verified email, recovery, and secure sessions. Department owners and administrators must complete authenticator-app two-step verification before department information or administrative controls become available. Members can enable the same protection voluntarily. Users can connect a backup authenticator and revoke every active session from their profile. Protected requests obtain the current identity and verification level from the authentication provider instead of trusting editable browser identity fields.
Browser and request protection
Unitavra uses same-origin request checks, bounded request sizes, authentication rate limits, private no-store responses, and browser security policies that restrict framing, plugins, device sensors, cross-origin resources, and insecure transport. These controls reduce common request-forgery, clickjacking, content-injection, and information-caching risks.
Department authorization
Server-side checks require active membership for every protected department read and change. Administrative actions require an administrator or owner role and verified two-step authentication; owner-only actions are checked separately. Multi-provider reports require each selected active provider to review and confirm from their own joined account. Department ownership transfers require a current-owner nomination and acceptance by the exact joined administrator. A browser-supplied department ID does not grant access.
Record integrity and accountability
Completed reports preserve a snapshot of the rig, checklist version, physical location, providers, confirmations, answers, and notes. Later checklist or ambulance-layout changes do not rewrite the report. New administrative audit entries retain both the displayed provider name and stable account and department-member identifiers. Department exports and record-printing actions are also recorded. Archiving is reversible preservation. Standard permanent disposal requires owner authority, an elapsed approved schedule, and no legal hold.
Storage and transmission
Connections use HTTPS. Operational records and rig-location maps use Cloudflare D1. Profile photos and any historical apparatus-reference photos are stored in a private Cloudflare R2 bucket and served only after an authorized account or department relationship is checked. The current ambulance editor uses Unitavra’s built-in hologram rather than accepting reference-photo uploads. Secrets are stored as server runtime settings and are not shipped to browsers or committed to source.
Vendors, payments, and backups
Cloudflare, Supabase, Resend, and Stripe provide infrastructure under their own security programs. Stripe handles payment details when billing is enabled. Department data exports provide portability, but customers should maintain any independent backups required by policy or law.
Monitoring and incident response
Unitavra uses service logs, rate controls, account-security history, and department audit events to support troubleshooting and investigation. Suspected security incidents are assessed, contained, remediated, and documented as appropriate. Notice will be provided to affected organizations or individuals when required by applicable law and available facts.
Customer responsibilities
Departments must maintain accurate access lists, protect devices and credentials, keep a backup authenticator available for administrative accounts, configure legal holds and retention authority correctly, train users not to enter patient information, and promptly report suspicious activity. No online service can guarantee absolute security.
Report a concern
Submit a security or access concern without passwords, patient information, authenticator setup keys, verification codes, exploit code, or sensitive evidence. Unitavra will arrange a safer channel if technical material is needed.