Security & HIPAA Compliance

1. Our Commitment

Rekupr handles sensitive medical billing information, and we take that responsibility seriously. Although Rekupr is not a HIPAA Covered Entity, we voluntarily apply safeguards consistent with HIPAA standards because your documents may contain Protected Health Information (PHI). We maintain a Business Associate Agreement with Google Cloud Platform for all services that process your document content.

2. Data Encryption

• In Transit: All connections use TLS 1.2 or higher, with HTTPS enforced across the entire platform.
• File Storage: Documents are stored with AES-256 server-side encryption on Google Cloud Storage.
• Database Fields: Sensitive fields such as patient names, procedure codes, and identifiers are encrypted at the application level using AES-256.
• Sessions: Session data is encrypted to prevent tampering or interception.

3. Passwordless Authentication

We use passwordless authentication via secure email links, which is more secure than traditional passwords:

• No passwords to steal: Eliminates risks from weak or reused passwords.
• Single-use tokens: Each sign-in link expires shortly after it is sent and can only be used once.
• Inherits email security: Benefits from your email provider's security protections, including 2FA.
• Rate limited: Protects against brute-force attempts.
• Google Sign-In: Optionally sign in with Google OAuth 2.0. Google OAuth is a separate service used solely for authentication, and it does not receive any of your document or health data.

4. Session & Access Controls

• Automatic timeout: Sessions expire after a period of inactivity.
• Concurrent session limits: We limit the number of simultaneous active sessions per account.
• Document isolation: We enforce ownership checks on document access, so your documents are scoped to your account.
• Staff access: Your files are protected with strict access controls and are only accessible to authorized personnel when necessary to operate, support, or secure Rekupr. Every access is recorded.
• Role-based access: Organization features use role-based permissions to control who can view and manage documents.

5. Document Processing

• Encrypted background jobs: Background jobs that carry document data use encrypted queue payloads.
• Log redaction: Sensitive health information is redacted from application logs.

6. Data Minimization & Retention

• Original files removed promptly: Once your document is analyzed, the original uploaded file is automatically deleted from our systems within 3 days. If a document cannot be analyzed, its original file is deleted within 90 days. Our storage provider keeps deleted files in a protected area for 7 more days before they are gone for good. Your analysis results are preserved; only the original file is removed to minimize data exposure.
• Analysis results kept until you delete them: Your bill analysis, extracted data, and reports stay available with no time limit. When you delete a report, it is permanently erased within 2 days.
• Audit logs kept at least 6 years: Access and security event logs are kept for compliance and investigation purposes. They hold no bill content.
• On-demand deletion: You can delete your account and associated data at any time from Account Settings.

7. Google Cloud Platform

All services that process your document content are consolidated under Google Cloud Platform, covered by a single HIPAA Business Associate Agreement (BAA):

• Document processing and analysis: AI document extraction and analysis on Google Vertex AI through its US-only endpoint, and error logging
• Encrypted storage: Temporary document storage with AES-256 encryption

Consolidating under one cloud provider with a single BAA simplifies our compliance posture and reduces the number of parties with access to your data.

Note: Google OAuth 2.0 (used for "Sign in with Google") is a separate service that only receives your email and name for authentication. It does not receive any document or health data and is not covered by the BAA.

8. Incident Response & Responsible Disclosure

In the event of a data breach affecting your information, we will notify affected users in accordance with applicable law. Notifications will include a description of the incident, the types of information involved, steps we are taking, and steps you can take to protect yourself.

If you discover a security vulnerability, please report it responsibly to paolo@rekupr.co. We appreciate the security research community's efforts in helping keep our users safe.

9. Questions or Concerns

If you have any questions about our security practices or want to report a security concern, please contact us:

Email: paolo@rekupr.co