Trust & Security
Last updated June 23, 2026
MintClinic is a clinical system of record for hearing-care practices, which means we hold Protected Health Information (PHI). Security is not a sales bullet for us. It is the floor the rest of the product is built on. This page is the operator-honest version of what that actually means.
Per-tenant isolation, enforced by the database
Every PHI table in MintClinic has PostgreSQL Row-Level Security enabled and forced. That means even the application’s own service role cannot bypass it. Every query is scoped to your clinic by the database, not by the application. There are no shared rows between tenants, and no “trust the ORM” surface area. We test this on every deploy with a multi-clinic self-test suite that asserts which records each role can and cannot see.
Tamper-evident audit chain
Every PHI read, write, signature, and export appends a row to a per-clinic, hash-linked audit log. Each row references the previous row’s hash, so any tampering or deletion is detectable. Daily anchors are signed with an ed25519 key, and the whole ledger is exportable for compliance review. You can audit your own clinic’s activity from inside the product; we don’t need to be in the loop.
Encryption in transit and at rest
- In transit: TLS 1.2+ with valid, verified certificates on every public surface.
- At rest: AES-256 for the database and object storage that holds PHI and clinical media.
- Secrets: stored in a managed vault, never committed to source, rotated on a schedule.
Authentication & access
Multi-factor authentication is available on every account and required for any role with PHI access. Sessions are HTTP-only and same-site, password hashes use a modern, slow KDF, and role / capability checks happen on the server for every privileged action, including actions initiated through Archie, our AI assistant. Destructive and financial actions require an explicit second confirmation.
AI & PHI
Archie (AI assistant) and SOAP-AI (dictated clinical notes) run under the same RLS and capability checks as the rest of the product. No model auto-signs a clinical note. No model executes a destructive or financial action without a typed confirmation. We use enterprise model endpoints with no-training, no-retention contractual terms; PHI is not used to train foundation models.
HIPAA & BAA
A countersigned Business Associate Agreement is included on every paid plan and is designed to satisfy 45 C.F.R. §§ 164.502(e), 164.504(e), and the HIPAA Security Rule. To request a copy, review redlines, or use your own paper, email baa@mintpath.ai.
Operational transparency
- Live status page: checks web app response, database connectivity, and whether authentication and payments are configured on every request. It is not a static “all green” image.
- Privacy Policy: what we collect, why, and how long we keep it.
- Terms of Service.
Reporting a vulnerability
If you believe you’ve found a security issue, please email security@mintpath.ai. We’ll acknowledge within one business day. Good-faith research is welcome and we will not pursue legal action against researchers who follow responsible-disclosure norms (no PHI access, no service disruption, give us reasonable time to fix).
This page is a plain-language summary of our security posture. The executed BAA and the Privacy Policy control where there is any conflict.