Built carefully, layer by layer.
Security at Averisq is treated as a product surface — not an afterthought. Here's an honest, current picture of what we do today and what's on the roadmap.
What's in place today
Role-based permissions
Owners, managers, clinicians, inspectors, and platform admins each see only what their role permits. Permissions are enforced server-side, not in the UI.
Practice data separation
Every record is scoped to a practice and protected by row-level security policies in the database.
Secure authentication
Email/password authentication with hashed credentials and session management handled by our identity provider.
Audit logging
Sensitive actions — report generation, downloads, role changes, sign-offs — are recorded to an immutable audit log.
Immutable sign-off ledger
Policy acknowledgements are stored with tamper-evident hashing so historical signatures can be verified.
Principle of least privilege
Service roles, server functions, and database policies are scoped to the minimum access needed for each operation.
Inspection & share controls
Time-bound, scope-limited share links for inspectors. Access can be revoked at any time and is fully logged.
Infrastructure
Hosted on Supabase (Postgres + auth + storage) with TLS in transit and encryption at rest.
On the roadmap
- • Multi-factor authentication (TOTP) with step-up to AAL2 for sensitive operations
- • Single sign-on (SSO) for group practices
- • Customer-controlled data export and account closure tooling
- • Formal third-party security assessment
Security is evolving alongside the platform
We don't claim certifications we haven't earned. As Averisq matures, our security posture will mature with it — and we'll update this page transparently as new controls and assessments land.
Responsible disclosure: if you believe you've found a security issue, please contact us so we can investigate. Contact details will be published before general availability.