Security & Trust
This page is maintained by EchoReview AI to answer common security and privacy questions about our research-preview echocardiography review platform. It is not a certification.
Platform controls in place today
Encryption
TLS 1.2+ in transit; AES-256 at rest for database, object storage, and backups.
Authentication
Email/password with password strength checks, Google OAuth, session management with short-lived JWTs and refresh rotation. MFA available on request.
Access control
Role-based access (technician, clinician, admin) enforced by row-level security (RLS) policies at the database layer. Organization-scoped data isolation.
Audit logging
Append-only audit log of study uploads, reads, sign-offs, addendums, and admin actions. Studies signed by a cardiologist are immutable — corrections go through explicit addendums.
Infrastructure
Hosted on Cloudflare Workers (edge compute) with Supabase (US region) for database, auth, and storage. HIPAA-eligible providers under BAA.
De-identification
Pre-upload de-identification checks strip DICOM PHI headers per the HIPAA Safe Harbor method. See our De-identification page.
Shared-responsibility model
EchoReview AI is responsible for
- Application security, RLS enforcement, and vulnerability response
- Encryption of data in transit and at rest
- Audit-log integrity and retention
- Subprocessor management and BAAs
- Incident response and customer notification
Cloud subprocessors are responsible for
- Physical security of data centers
- Network security, DDoS mitigation, and edge WAF
- Underlying database, storage, and compute availability
- Certificate and key management for their platforms
Your organization is responsible for
- Executing a BAA before uploading any PHI
- Verifying de-identification of research data
- Managing user accounts, roles, and offboarding
- Cardiologist review before any clinical action
- Local IRB approval for pilot studies
Subprocessors
| Provider | Purpose | Region |
|---|---|---|
| Supabase (via Lovable Cloud) | Auth, database, storage, edge functions | US |
| Cloudflare Workers | Application hosting and edge compute | Global edge (US primary) |
| Mailgun | Transactional email delivery | US |
| Google Gemini / OpenAI (Lovable AI Gateway) | AI inference on de-identified data | US |
Security contact
To report a suspected vulnerability, security incident, or data-handling concern, email contact@echoaireview.com. Please do not publicly disclose issues before we've had a reasonable window to respond.