Accounts
- Passwords stored as scrypt hashes
- Optional two-step sign-in with an authenticator app
- Sign-in throttling and a challenge after failed attempts
- Automatic sign-out after a set idle time
Security
Trust is part of the mission
You hold sensitive information about real people. Here is what Missionly does to protect it, in plain language.
Access
- Roles control each module: none, read, write or manage
- Case workers can be limited to their own caseload
- Portal users see only their own information
- Fern follows the same rules as the person asking
Accountability
- An audit log of sign-ins, views and changes
- Version history on records
- Confidential case notes
- Data export whenever you need it
The web app
- A strict content security policy
- Protection against cross-site form attacks
- Session tokens stored only as hashes
- Upload checks on file type and size
A note on compliance
Access controls and audit logs support requirements such as HIPAA, but software alone doesn't make an organization compliant. Compliance also depends on your hosting, your policies and how your team works. We are happy to talk through your situation.