Security & Privacy

In an era where data breaches make headlines daily and privacy concerns dominate public discourse, the imperative for robust security measures has never been more critical—especially in healthcare and medical research. At Care Hub, we recognize that our participants are not just users; they are partners in advancing cancer research, and they deserve nothing less than enterprise-grade protection for their information and contributions.

Security and privacy are not afterthoughts in our platform—they are foundational principles woven into every line of code, every database query, and every user interaction. We understand that the trust placed in us by cancer patients, survivors, caregivers, and healthcare professionals is sacred. This trust demands that we implement security measures that rival those of Fortune 500 healthcare institutions, major financial services firms, and government agencies handling classified information.

Our commitment extends beyond mere compliance with regulations like HIPAA, GDPR, and CCPA. We have architected our platform with a "security-first" philosophy, implementing multiple layers of protection including end-to-end encryption, multi-factor authentication, row-level database security, automated backup systems with military-grade encryption, and continuous monitoring for threats. Every administrative access requires not only cryptographic verification but also a legally binding non-disclosure agreement with electronic signatures that meet the highest standards of legal validity.

We have partnered with industry leaders—Supabase, Netlify, and Google—all of whom maintain SOC 2 Type II certifications and demonstrate unwavering commitment to data protection. Our infrastructure leverages the same security protocols used by healthcare systems protecting millions of patient records, banks securing billions in assets, and technology companies trusted by governments worldwide.

This document represents our transparency pledge. We believe our community deserves to know exactly how we protect their data, what measures we've implemented, and why we've made specific architectural decisions. Whether you're a cybersecurity professional scrutinizing our protocols, a cancer researcher evaluating our platform's suitability for sensitive studies, or a beta participant seeking assurance about your privacy, this comprehensive documentation provides complete visibility into our security infrastructure.

The fight against cancer requires collaboration, innovation, and above all, trust. We take our responsibility as stewards of that trust with the utmost seriousness, and we're committed to maintaining security standards that make Care Hub a model for privacy-respecting, enterprise-grade healthcare research platforms. We continuously monitor emerging threats, update our security measures, and seek feedback from the cybersecurity community to ensure our platform remains secure, compliant, and trustworthy.

🔐 Key Security Highlights

• ✅ Multi-Factor Authentication (MFA) with TOTP support
• ✅ Row-Level Security (RLS) on all database tables
• ✅ End-to-End Encryption for data in transit and at rest
• ✅ HIPAA-Compliant Architecture with PHI protection measures
• ✅ Zero-Knowledge User Identification via CCH IDs
• ✅ Automated Backup Systems with encryption and redundancy
• ✅ Bot Protection & Rate Limiting against malicious attacks
• ✅ Email Verification & Secure Recovery protocols
• ✅ Professional Audit Trails for compliance reporting
• ✅ SOC 2 Type II Certified Partners (Supabase, Netlify, Google)

Multi-Factor Authentication (MFA)

Implementation Status: ✅ Active

Our platform supports industry-standard multi-factor authentication methods:

• TOTP (Time-based One-Time Passwords)
  • Compatible with Google Authenticator, Authy, 1Password, etc.
  • 30-second token rotation
  • RFC 6238 compliant
• Optional Enhancements:
  • SMS-based verification (configurable)
  • WebAuthn support for hardware security keys
  • Backup recovery codes

Configuration Location: Supabase Authentication Settings → Multi-Factor Authentication

Invite-Only Registration System

Security Level: High

• Controlled Access: All user registrations require validated invite codes
• Google Sheets Integration: Invite codes stored and managed in secure Google Sheets
• Real-time Validation: Webhook-based verification ensures codes cannot be reused
• Audit Trail: Complete tracking of invite code generation, distribution, and usage

Email-Based Authentication

Migration Date: October 2025 | Security Improvement: Enhanced privacy and usability

• No Username Required: Users authenticate with email addresses only
• Automatic CCH ID Generation: Anonymous tracking system for privacy
• Backward Compatibility: Existing username-based accounts remain functional
• Email Verification Required: All accounts must verify email addresses

Admin Access Security

HIPAA Compliance Level: Full

Two-Factor Admin Authentication

1. Email Verification: 6-digit cryptographic verification code
   • 10-minute expiration window
   • Single-use only
   • Cryptographically secure generation (crypto.randomBytes)
2. NDA Agreement: Legally binding electronic signature required
   • SHA-256 document hashing for integrity verification
   • Immutable storage with timestamping
   • ESIGN Act compliant electronic signatures
   • PDF confirmation sent via secure email
3. Access Code Validation: Role-based access control (RBAC)
   • Unique access codes per admin level
   • Hierarchical permission system
   • Regular rotation schedule

Secure Login Token System

• Token Generation: 256-bit entropy using crypto.randomBytes(32)
• One-Time Use: Tokens consumed immediately upon validation
• 10-Minute Expiration: Maximum security window
• No Password Transmission: Industry-standard passwordless authentication
• Automatic Cleanup: Expired tokens purged automatically

Session Management

• Secure Session Tokens: JWT-based with cryptographic signatures
• Automatic Expiration: Configurable timeout periods
• Single Sign-On (SSO) Ready: Architecture supports future SSO integration
• Session Invalidation: Immediate logout across all devices when needed

Account Lockout Protection

Supabase PostgreSQL Infrastructure

Provider: Supabase (Built on PostgreSQL 15+)
Security Certification: SOC 2 Type II Compliant

Core Database Security Features

Encryption at Rest:

• AES-256 encryption for all stored data
• Encrypted backups with separate key management
• Secure key rotation protocols

Encryption in Transit:

• TLS 1.3 for all database connections
• Forced SSL for all client connections
• Certificate pinning for added security

Row-Level Security (RLS)

Implementation Status: ✅ Active on All Tables
Performance Optimization: Completed October 2025

RLS Policies by Table

Users Table:

-- Service role has full access
-- Users can only access their own records via auth.uid()
-- Email-based access control with JWT validation

User Module Completions:

-- Consolidated single optimized policy
-- user_id = auth.uid() for user access
-- Service role bypass for admin operations
-- Prevents cross-user data access

Password Resets:

-- Anonymous users can create reset requests
-- Users can access own reset tokens only
-- Service role for admin password recovery
-- Automatic expiration enforcement

NDA Agreements:

-- Immutable after creation (DELETE prohibited)
-- Users can read own NDA records
-- Service role for audit access
-- Timestamped with cryptographic hashing

Performance Optimization

Service Role Protection

• Separate API Keys: Anonymous vs. Service Role keys
• Environment Variable Storage: Never exposed to client
• Scoped Permissions: Minimal necessary privileges
• Regular Key Rotation: Scheduled security updates

Privacy-First Architecture

Anonymous User Tracking (CCH ID System)

Concept: Zero-knowledge identification

• Unique CCH IDs: Generated for each user (format: CCH-XXXXXX)
• No Direct PII: Analytics and leaderboards use CCH IDs only
• Reversible Only by Admins: Secure lookup table in isolated database
• GDPR Compliant: Right to erasure fully supported

Data Minimization

Philosophy: Collect Only What's Necessary

Data Points Collected:

• ✅ Email address (required for authentication and communication)
• ✅ Password (bcrypt hashed with 10 salt rounds, never stored in plain text)
• ✅ Module completion data (for progress tracking)
• ✅ Timestamp data (for analytics and security auditing)
• ❌ No Social Security Numbers
• ❌ No Medical Record Numbers
• ❌ No Direct PHI (Protected Health Information)
• ❌ No Payment Information

HIPAA Compliance Architecture

Current Status: HIPAA-Ready Infrastructure

While the beta program focuses on usability testing (not clinical data collection), the platform is architected for HIPAA compliance:

Technical Safeguards:

• Unique user identification and emergency access procedures
• Automatic logoff after inactivity periods
• Encryption and decryption mechanisms
• Audit controls and integrity controls
• Person/entity authentication

Administrative Safeguards:

• Security management process
• Assigned security responsibility
• Workforce security and training
• Information access management
• Security incident procedures

Physical Safeguards:

• Cloud infrastructure with certified data centers
• Workstation and device security policies
• Facility access controls (managed by hosting providers)

GDPR & CCPA Compliance

GDPR (European Union)

Data Subject Rights:

• ✅ Right to Access - Users can request all data
• ✅ Right to Rectification - Users can update information
• ✅ Right to Erasure - Complete account deletion available
• ✅ Right to Data Portability - Export in standard format
• ✅ Right to Restrict Processing - Opt-out mechanisms
• ✅ Right to Object - Marketing communications opt-out

CCPA (California)

Consumer Rights:

• Right to Know: Disclosure of collected data
• Right to Delete: Account and data deletion
• Right to Opt-Out: Sale of personal information (N/A - we don't sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices

Data Retention & Deletion

Beta Testing Phase:

• Personal data retained during beta period only
• Aggregated/anonymized data retained indefinitely for research
• Individual deletion requests honored within 30 days
• Complete account deletion available on request

Post-Beta:

• Compliance with applicable data protection laws (GDPR, CCPA, HIPAA)
• Automated data retention policy enforcement
• Secure data destruction protocols
• Audit trail of deletions

SMTP Configuration

Email Provider: Gmail SMTP (Production-Ready)
Security Level: Industry Standard

Configuration:

• SMTP Host: smtp.gmail.com
• SMTP Port: 587 (STARTTLS)
• Authentication: App-specific passwords (not account passwords)
• Encryption: TLS 1.2+ enforced
• SPF/DKIM: Configured for deliverability and anti-spoofing

Email Account: research.carehub@gmail.com

• 2-Factor Authentication enabled on Google account
• App-specific password generated for SMTP
• Regular password rotation schedule
• Access audit logs maintained

Email Verification System

Email Address Validation

1. Format Validation: RFC 5322 compliant regex
2. Disposable Email Detection: Blocks temporary email services
3. Domain Verification: DNS MX record lookup
4. Deliverability Check: SMTP connection validation

Verification Code System

• 6-Digit Numeric Codes: Easy to read and enter
• Cryptographically Secure: crypto.randomBytes()
• 10-Minute Expiration: Balance security and usability
• Single-Use Only: Codes invalidated after verification
• Branded Templates: Professional HTML emails

Anti-Phishing Measures

Rate Limiting

• Maximum 5 emails per user per hour
• Prevents abuse and spam
• Automatic cooldown periods
• Admin override capability for legitimate cases

Password Storage

Hashing Algorithm: bcrypt
Security Standard: Industry Best Practice

• Salt Rounds: 10 (balances security and performance)
• Unique Salt Per Password: Prevents rainbow table attacks
• One-Way Hashing: Passwords cannot be decrypted, only verified
• Password History: Previous passwords tracked to prevent reuse

Password Requirements

Minimum Security Standards:

• Minimum 8 characters length
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• Special characters recommended

Client-Side Validation:

• Real-time password strength indicator
• Common password detection (10,000+ leaked passwords blocked)
• Visual feedback during password creation
• No passwords in emails (ever)

Password Reset Protocol

Security-First Approach: Multi-Step Verification

Account Recovery Safeguards

9.1 Hosting & Deployment

Platform: Netlify (Enterprise-Grade Serverless)
Security Certifications: SOC 2 Type II, ISO 27001

SSL/TLS Encryption

Encryption Standard: TLS 1.3
Certificate Authority: Let's Encrypt

• HTTPS Enforced: All HTTP traffic redirected to HTTPS
• HSTS Enabled: HTTP Strict Transport Security headers
• Perfect Forward Secrecy: Session keys unique per session
• Automatic Certificate Renewal: Zero-downtime updates

9.3 Bot Protection & Rate Limiting

Database-Level Rate Limiting

Status: ✅ Active

Rate Limits by Action:

• Registration: 5 attempts per hour per IP
• Login: 10 attempts per hour per IP
• Password Reset: 3 attempts per hour per IP
• Email Sending: 5 emails per hour per user

Features:

• IP-based tracking with INET data type
• Exponential backoff (10 minutes × attempts over limit)
• Automatic cleanup of expired entries
• Service role bypass for admin operations

Environment Variable Security

API Security

• CORS Protection: Configured allowed origins
• Request Validation: Input sanitization on all endpoints
• Authentication Required: JWT validation on protected routes
• SQL Injection Prevention: Parameterized queries only
• XSS Protection: Content Security Policy headers

Automated Backup Systems

Backup Strategy: 3-2-1 Approach (3 copies, 2 media types, 1 offsite)

Codebase Backups

Script: backup-codebase.sh | Frequency: On-demand and pre-deployment

What's Backed Up:

• ✅ All source code files
• ✅ Configuration files (sanitized, no secrets)
• ✅ Documentation
• ✅ Database migration scripts
• ❌ node_modules (excluded for size)
• ❌ .next build artifacts (excluded)
• ❌ Environment variables (excluded for security)

Database Backups

Supabase Automatic Backups:

• Daily Automated Backups: Retained for 7 days
• Point-in-Time Recovery: Available for extended retention
• One-Click Restore: Via Supabase dashboard

Local Development Backups

Tool: ChronoSync | Frequency: Real-time synchronization

• Purpose: Local development environment protection
• Destination: Encrypted external storage
• Security Measures:
  • Excludes sensitive files (.env, credentials)
  • Encrypted destination volume
  • Local network only (no cloud sync)
  • Version history maintained
• Benefits: Rapid recovery from development workstation failures, version history for rollback

Enhanced User Data Backup:

Script: enhanced-user-data-backup.sh | Frequency: Weekly

NDA Document Storage

Critical Security Component: Legal Document Preservation

Security Features

• SHA-256 Hashing: Every NDA hashed immediately upon signing
• Immutable Records: Database constraints prevent modification
• Tamper Detection: Hash verification on every access
• Audit Trail: All access attempts logged

Legal Compliance

• ESIGN Act Compliant: Electronic signatures legally binding
• Timestamp Verification: Cryptographic timestamping
• IP Address Logging: Geographic verification
• Complete Agreement Text: Full content stored

Disaster Recovery Plan

RTO (Recovery Time Objective): 4 hours
RPO (Recovery Point Objective): 24 hours

Architecture Overview

Purpose: Invite code management and user tracking
Security Model: Webhook-based with validation

Google Sheets Ecosystem:

• Invite Codes Sheet - Prospect and invite code tracking
• Access Requests Sheet - Beta signup requests
• VIP List - High-priority contacts
• Combined User List - Consolidated user view

Google Apps Script Security

Deployment: Web App with authentication

Data Synchronization Security

Real-Time Validation Process:

1. User submits invite code during registration
2. Next.js API validates format and basic checks
3. Secure HTTPS call to Google Apps Script webhook
4. Google Script checks sheet for valid, unused code
5. Returns validation result (no sensitive data exposed)
6. Upon successful registration, webhook updates usage status

Access Control

• Google Account Security: 2FA required on managing account
• Limited Sharing: Owner + select admins only
• Audit Logs: Enabled for all sheet access
• Regular Access Review: Quarterly
• Link Sharing: Disabled

Non-Disclosure Agreements (NDAs)

Requirement: All admin users must sign legally binding NDA

Electronic Signature Process

1. Email verification (6-digit code, 10-minute expiration)
2. NDA text display with scroll requirement
3. Typed full name (electronic signature)
4. Agreement to terms checkbox
5. Submit button generates SHA-256 hash
6. Immutable database record created
7. PDF confirmation emailed immediately

HIPAA Compliance

Status: HIPAA-Ready Architecture (Full compliance upon clinical data collection)

Current Implementation:

• Administrative safeguards in place
• Technical safeguards implemented
• Physical safeguards via certified providers
• Business Associate Agreements ready for execution

HIPAA Training:

• All admin users complete HIPAA awareness training
• Annual refresher training required
• Documentation of training completion
• Sanctions policy for violations

12.3 GDPR & CCPA Compliance

GDPR (European Union)

Data Subject Rights:

• ✅ Right to Access - Users can request all data
• ✅ Right to Rectification - Users can update information
• ✅ Right to Erasure - Complete account deletion available
• ✅ Right to Data Portability - Export in standard format
• ✅ Right to Object - Marketing communications opt-out

CCPA (California)

Consumer Rights:

• Right to Know: Disclosure of collected data
• Right to Delete: Account and data deletion
• Right to Opt-Out: Sale of personal information (N/A - we don't sell data)
• Right to Non-Discrimination: Equal service regardless of privacy choices

Consent Management

Security Monitoring

Real-Time Monitoring:

• Failed login attempt tracking
• Unusual access pattern detection
• Rate limit violation alerts
• Database query performance monitoring
• SSL certificate expiration warnings

Logging Infrastructure:

• Application logs (Next.js server logs)
• Database logs (Supabase audit logs)
• Email delivery logs (SMTP provider)
• Webhook execution logs (Google Apps Script)

Log Retention:

• Security logs: 1 year minimum
• Application logs: 90 days
• Database audit logs: 7 years (compliance)
• All logs encrypted at rest

Incident Response Plan

Response Procedures

1. Detection: Automated alerts or user report
2. Assessment: Severity classification
3. Containment: Isolate affected systems
4. Investigation: Root cause analysis
5. Remediation: Fix the vulnerability
6. Recovery: Restore normal operations
7. Post-Incident: Review and lessons learned

Security Audit Schedule

Internal Audits:

• Weekly: Access log review
• Monthly: Security configuration review
• Quarterly: Penetration testing (self-assessment)
• Annually: Comprehensive security audit

External Audits:

• Annual third-party security assessment (planned)
• Compliance audit (upon full production launch)
• Code review by security experts

Infrastructure Providers

Security Standards Adherence

OWASP Top 10 Protection

• ✅ A01:2021 - Broken Access Control (RLS policies)
• ✅ A02:2021 - Cryptographic Failures (TLS, bcrypt, AES-256)
• ✅ A03:2021 - Injection (Parameterized queries)
• ✅ A04:2021 - Insecure Design (Security-first architecture)
• ✅ A05:2021 - Security Misconfiguration (Environment variables)
• ✅ A06:2021 - Vulnerable Components (Regular updates)
• ✅ A07:2021 - Authentication Failures (MFA, rate limiting)
• ✅ A08:2021 - Software Integrity (Code signing, checksums)
• ✅ A09:2021 - Logging Failures (Comprehensive logging)
• ✅ A10:2021 - SSRF (Input validation, allowlist)

NIST Cybersecurity Framework

• Identify: Asset inventory and risk assessment
• Protect: Access control, encryption, training
• Detect: Continuous monitoring and alerts
• Respond: Incident response plan and procedures
• Recover: Backup and disaster recovery systems

Best Practices Implementation

• Security Development Lifecycle: Threat modeling, code review, automated testing
• Principle of Least Privilege: Minimal permissions, RBAC, regular access reviews
• Defense in Depth: Multiple security layers, no single point of failure
• Assume Breach Mentality: Prepared for worst-case scenarios

Planned Improvements (Q4 2025 - Q1 2026)

Research & Development

Emerging Technologies:

• Blockchain-based audit trails (immutable logging)
• Homomorphic encryption (computation on encrypted data)
• Zero-knowledge proofs (privacy-preserving verification)
• Federated learning (privacy-preserving ML)

Security Team Contact

Email: research.carehub@gmail.com

Response Times:

• Critical Security Issues: < 1 hour
• General Security Questions: < 24 hours
• Compliance Inquiries: < 48 hours

Responsible Disclosure

How to Report Security Vulnerabilities:

1. Email security concerns to: research.carehub@gmail.com
2. Include detailed description and reproduction steps
3. Allow 24 hours for initial response
4. Do not publicly disclose until issue is resolved

Recognition:

• Security researchers will be credited (with permission)
• Hall of fame for responsible disclosures (planned)
• Monetary rewards for critical vulnerabilities (production)

Acknowledgments: This security documentation represents the collective effort to build a secure, privacy-respecting platform for cancer research advancement. We thank all beta participants for their trust and collaboration.