Home › Security

Security & data handling

Interstate Medicine Ledger · Last updated: October 8, 2026

The Ledger holds a clinician’s licensing and credentialing record. This page says, in plain terms, where that record lives, who can see it, and what we do and do not claim. When something here changes, we change this page.

At a glance

What we hold, and what we don’t

We hold a clinician’s own professional record: licenses and renewal dates, DEA and state controlled-substance registrations, board certifications, life-support cards, malpractice coverage, work history, CME certificates, the clinician’s own immunization and TB records if they add them, and the documents behind each of these. Date of birth and a photo ID are optional.

We do not hold patient records. Nothing in the Ledger is protected health information about patients. We do not accept or store Social Security numbers: the document reader is told never to read one, and any nine-digit number shaped like one is removed from its answer before it reaches your screen.

Where it lives

• Database and files: Supabase (Postgres and file storage), in its US East region. Netlify serves the web app and this site.
• In transit: every connection uses TLS. Browsers are told to use HTTPS only (HSTS).
• At rest: data and files are encrypted at rest by our hosting providers.

Who can see what

Every table in the database has row-level security switched on, and new tables get it automatically. The database itself, not the app, decides what each signed-in person can read.

• A clinician sees only their own record.
• An organization (an agency, telehealth group or practice) sees a clinician only after that clinician approves it, and only at the level the clinician picks. The clinician can lower or revoke access at any time.
• Every grant, change and revocation, every change an organization or helper makes, and every attempt blocked for too low a level is written to the clinician’s own activity log. When an organization views a clinician’s roster entry or credential expiry dates, that is logged there too. The clinician can download that log.
• Signed attestations: when a clinician signs the attestation and release, an organization with access sees that it was signed and when. It never sees the clinician’s answers to the disclosure questions.
• Packets shared by link: a clinician can share a packet with an organization or a facility by link. The link lasts 7, 30 or 90 days, as the clinician chooses, and the clinician can revoke it. Whoever opens it sees a summary (what the clinician holds and when each item expires, with no license, DEA or policy numbers, no date of birth, no contact details and no health results) and can download the packet. Every opening and every download is listed for the clinician.
• An organization’s own activity log: owners and managers can download it as a spreadsheet.
• Organization API keys are read-only. We store only a SHA-256 hash of each key; the key itself is shown once, when it is created, and can be revoked at any time.

Signing in

• New passwords are checked against known breached passwords. Only the first five characters of the password’s hash leave your device for this check.
• Two-factor sign-in with an authenticator app (TOTP) is available to every account. Once it is on, the code is asked for at every sign-in.
• Organizations can require it. An owner can require it for every admin; the database blocks any admin who has not passed it.
• Photo-ID documents can only be opened from a session that has passed the two-factor check. The file store and the database both enforce this.
• Changing your password or email, turning off two-factor, and deleting the account all ask for your password again.

How documents are read

• A document you add is first processed on your own device: its text is pulled out, or read with on-device OCR, and images are compressed.
• That text and an image of the first page then go to our AI reader, which runs on Anthropic’s API. It identifies the document and suggests the fields. Anthropic does not use API traffic to train its models. The reader is sent only what the document itself shows, never your account details.
• Each reading is stored by the file’s fingerprint (a SHA-256 hash), so adding the same file twice doesn’t send it again. These stored readings are deleted after 90 days.
• Nothing you upload is added to your record until you review it and confirm. If the AI reader is unavailable, the on-device reading is shown instead and labeled as such.

Email and payments

• We send email through Resend. Documents emailed to your private email-in address can be filed for you only when they come from a sender you have approved and the sender’s domain passes SPF or DKIM. Those are read the same way as an upload and filed the next time you open the Ledger, only when every check passes (the name matches yours, it is not already on file, and the reading is certain), with an Undo. Anything else waits for your review, and email from a sender you have not approved is held until you approve it.
• Payments go through Stripe’s hosted checkout. We never see or store card numbers.

Keeping and deleting data

• Your copy, any time: download a ZIP of your whole record, with spreadsheets and the original files.
• Delete your account, any time, from Settings. Your uploaded files are removed from file storage first, then your account and your record are removed from our database. If a file cannot be removed, the account is not deleted and you are asked to try again, so nothing is left behind.
• Set retention: stored AI readings are kept for 90 days. Emailed-in items are kept for 180 days once filed or dismissed, and 30 days if they never matched an account. Your activity log is kept for up to six years while your account exists.

Exclusion and registry checks

Once a month we compare each clinician’s name and NPI with public lists: the OIG exclusion list (LEIE), the CMS opt-out and Order & Referring files, and the NPPES registry. We download the exclusion list and the NPPES deactivation file and compare them ourselves. For the CMS opt-out, Order & Referring and NPI registry checks we send only the NPI to the official CMS lookup, never a name or any other detail. An organization can also run a SAM.gov exclusion check, which sends the clinician’s name to SAM.gov’s public search. Results are shown to the clinician, and to an organization only if the clinician has given it access; a match made on the NPI is shown to an organization only at level 2 or above. A name match is shown as a possible match for a person to review, never as a finding on its own.

Browser protections

The app sends HSTS, a Permissions-Policy that turns off camera, microphone, location, payment and similar browser features, and a rule that stops other sites from framing it. Our Content Security Policy currently runs in report-only mode. We collect its reports and will switch it to enforcing once they are clean.

What we do not claim

• No SOC 2 report yet, and no HITRUST certification. We are preparing for an independent SOC 2 audit. Our hosting providers hold their own attestations; we do not.
• No HIPAA business associate agreement, because we do not handle patient health information.
• No primary-source verification. We are not a credentials verification organization (CVO). The Ledger organizes what the clinician holds. Boards, facilities and payers still do their own verification.

Service providers that handle data

For your security review

We fill in security questionnaires and walk teams through our data handling. Email hello@interstatemedicine.com with “Security review” in the subject.

Report a security issue

If you think you have found a vulnerability, email hello@interstatemedicine.com with “Security” in the subject. Please give us a reasonable chance to fix it before you share it. Our contact details are also in /.well-known/security.txt. See also our Privacy Policy.