Security, stated plainly.
What protects your registry today — and what we do not claim.
Access control
Every practice authenticates with its own API key. Keys are stored only as SHA-256 hashes — the same treatment as a password — and a key can only ever read or write its own practice's records. There is no cross-practice access path in the API.
Audit trail
Every create, update, and delete is written to your practice's append-only audit log with a timestamp, so changes to credential data are attributable and reviewable.
Data minimization
The registry holds provider administrative data only. The product has no patient-data fields by design; the smallest data set is the safest one.
Honest limits
CredTrack v1 is a young service on a single-node store. We do not hold security certifications and we do not claim any — no SOC 2, no "HIPAA compliant" badge, no compliance guarantees. Practices with formal vendor-security requirements should evaluate us against the facts above and their own counsel's advice. Encryption in transit (TLS) is applied at deployment; key rotation and export tooling are on the roadmap and announced when shipped, not before.
Reporting
Security issues: don+credtrack@lifeofmorr.com. We read every report.