Trust
Security at Pawmetrix
Your clinic trusts us with patient records, client details and payments. Here is how we protect them.
Your clinic's data stays your clinic's
- Every clinic's records are separated by the database itself (row-level security), not just by the app. A request for another clinic's data returns nothing, even if the app had a bug.
- New tables are protected automatically the moment they are created, and an automated check refuses any database change that leaves a table unprotected.
- A dedicated test suite signs in as real accounts from different clinics and proves none of them can read, change or delete another clinic's records.
Signing in
- Two-factor sign-in with an authenticator app is available to every staff account.
- Password rules and sign-in rate limits are enforced by our sign-in provider, not only on the screen.
- Shared front-desk and exam-room computers can lock themselves after a set idle time. Unlocking takes the person's own password, and repeated wrong passwords sign the computer out.
- Staff can see every device they are signed in on and sign any of them out. Changing a password signs out the other devices, and managers can sign a team member out everywhere at once.
The right access for each role
- Owners, admins, veterinarians, technicians and front-desk staff each get permissions that match their job. The database enforces them, so a hidden button is never the only protection.
- Deactivating or removing a team member ends their access, including on devices already signed in, within a minute.
- Controlled-substance records, rabies certificates and signed medical records have additional rules about who can create, issue or change them.
A record of who did what
- Sensitive actions such as refunds, permission changes, rabies certificate issuance and device sign-outs are written to an audit trail with the person, time and device.
- Signed medical records are locked. Corrections are added as dated addenda instead of overwriting what was signed.
Encryption and infrastructure
- All traffic is encrypted in transit (HTTPS with HSTS), and the app sends browser security headers that block framing and other common attacks.
- Data is stored with Supabase on Amazon Web Services in the United States, encrypted at rest by the provider.
- Card payments are processed by Stripe. Pawmetrix never stores card numbers.
Pet owners
- Owners invited to a clinic's client portal sign in with a one-time code sent to the email the clinic has on file. They see only their own pets.
- Chart notes, internal comments, patient alerts, costs, unsigned records and unreviewed lab results are never shown to owners. Owners can send requests; the clinic approves every change.
Report a security issue
If you believe you have found a security problem, email info@pawmetrix.com with "Security" in the subject. Please give us a reasonable time to fix it before sharing it publicly, and don't access or change data that isn't yours. We reply to every report.