A platform designed for the European medical world
Hosting in the European Union, encryption in transit and at rest, GDPR-compliant processing and OWASP security headers. Here is how we protect your data and the trust of QA/RA professionals.
European hosting
Your data is stored within the European Union: database in Paris, application in Frankfurt, emails sent from Ireland. Only the AI features send text outside the EU, and only when you use them.
- Database: Supabase, Paris (eu-west-3)
- Application: Render, Frankfurt (Germany)
- Emails: Resend, Ireland (eu-west-1)
- Payments: Stripe, Ireland
- CDN and protection: Cloudflare, global network
Strict data partitioning
Every table enforces partitioning in the database itself, not only in application code. One organisation cannot read another's data, even if the application were compromised.
- Row Level Security active on 39 tables out of 39
- 59 access policies enforced by PostgreSQL
- Per-organisation isolation verified table by table
- Privileged functions unreachable from the browser
- Service key never exposed client-side
Encryption in transit and at rest
HTTPS required for all exchanges, AES-256 for data at rest. Your data is never transmitted in clear text.
- HTTPS enforced via HSTS (preloaded)
- Automatically renewed TLS certificates
- AES-256 encryption of data at rest (Supabase)
- TLS 1.3 by default, 1.2 at minimum
Reinforced authentication
Two-factor authentication with an authenticator app, passwords stored as irreversible hashes, Cloudflare Turnstile CAPTCHA against automated attacks.
- Two-factor authentication (TOTP code) in Settings > Security
- bcrypt hash on Supabase Auth (industry standard)
- Cloudflare Turnstile CAPTCHA on signup
- Mandatory email verification (PKCE flow)
- Secure sessions (httpOnly cookies)
HTTP security headers
Complete OWASP header configuration to block XSS, clickjacking and MIME-sniffing.
- Strict-Transport-Security (HSTS preload)
- Strict Content-Security-Policy
- X-Frame-Options: SAMEORIGIN
- X-Content-Type-Options: nosniff
- Restrictive Permissions-Policy
- Referrer-Policy: strict-origin-when-cross-origin
Anti-DDoS & edge protection
Cloudflare at the front protects against volumetric and application-layer attacks.
- Automatic L3/L4/L7 DDoS protection
- Per-IP rate limiting on public entry points (contact, newsletter signup, partner application)
- Turnstile CAPTCHA on exposed forms
- Anonymous cookieless analytics
Transparency on AI
The QARA Assistant and Document IA rely on models hosted in the United States. We would rather say so plainly, and say exactly what they receive.
- Sent: your question, the attached document, your role, your scope and up to 15 declared devices
- Never your name, your email or your billing data
- Attached documents read then forgotten, no copy kept
- API terms excluding training on your content
- Transfers governed by Standard Contractual Clauses
- Monitoring, filters, alerts and exports work without these two features
GDPR compliance
A platform designed for GDPR from the start. User rights are easily accessible.
- Data hosted in the EU
- Transparent privacy policy
- Right of access, rectification, erasure
- Data portability
- No tracking cookies
- Breach notification (Art. 33)
Important notice
MedQara is a monitoring support tool. AI analyses are indicative. For any regulatory decision, the user must always consult the referenced official source and, where appropriate, the opinion of a qualified QA/RA expert.
Report a vulnerability
If you discover a security flaw, contact us directly. We commit to responding within 48h and fixing critical issues quickly.
contact@veillemedqara.fr