Security & trust
The page your compliance officer is looking for
You hold protected health information; we hold it for you. Here is exactly how, in one place, stated plainly enough to be checked.
HIPAA and business associate agreements
EndpointEMR is built for protected health information, and we operate as a business associate to the practices we serve. A business associate agreement with your practice is part of onboarding: email support@endpointemr.com and we will execute one before your first real chart.
Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest by our database and hosting providers. Card numbers never reach our servers at all: payment collection is handled end to end by Stripe, and what we store is a reference token.
Tenant isolation the database enforces
Every practice's records are separated by row-level security policies inside PostgreSQL itself, enforced for every query the application runs. Isolation does not depend on application code remembering to filter; the database refuses cross-practice access even if a query forgets to ask correctly.
Audit trail
Every sign-in, view, edit and payment writes an audit record: who, what and when. When your compliance reviewer asks who touched a chart, the answer exists and is exportable.
Access control
Role-based permissions govern what each team member can see and do, from front desk to medical director. Two-factor authentication is available to every account, and someone who leaves your team stops having access the moment you deactivate them.
Backups that are actually tested
The database is backed up continuously by our hosting provider, and we independently dump and restore production on a schedule, verifying every table's row count against the source. A backup that has never been restored is a hope; ours are restored and checked.
Availability
Current system state is public at endpointemr.com/status, and our monitoring pages us before your front desk notices. When something does go wrong, the status page is where we say so.
Breach notification
If a security incident affects your practice's data, we notify you without undue delay, with what we know, what it touched and what we are doing, so your practice can meet its own notification obligations.
Your data, your exit
Your practice's records are exportable in full, at any time, by you. Cancellation never deletes your data on our initiative, and an unpaid subscription never blocks you from reading or exporting your own charts.
Reporting a vulnerability
If you believe you have found a security issue, email support@endpointemr.com with “security” in the subject. A person reads it, we respond, and we will never take legal action against good-faith research that respects patient data.
Subprocessors
A short list, on purpose. Each receives only what its job requires, and this table is the current, complete inventory.
| Provider | Role | What it touches |
|---|---|---|
| Neon | Database hosting | Practice and patient records (encrypted) |
| Vercel | Application hosting | Application traffic |
| Stripe | Payments and billing | Payment details, held by Stripe alone |
| Resend | Email delivery | Recipient addresses and message content |
| Twilio | Text messaging | Phone numbers and message content |