Skip to content
PortoMD

Internal · SOP-SEC-001 · v1.1 · October 2026

Security & Data Protection Practices

How Porto MD protects business and health information: who can see what, how sign-in works, how data is encrypted and backed up, and exactly what we do if something goes wrong.

1 · Access control

  • Deny-by-default row-level security: every role (admin, clinic/provider, rep, supplier) can read only its own organization's data. Cross-tenant reads are blocked at the database layer, not just the UI.
  • Suppliers receive the minimum necessary to fulfill: ship-to details and items. They never see medical questionnaires, prescriptions, pricing/margins, or other organizations' data.
  • Prescription data flows only through licensed providers; the release engine re-verifies provider approval on every dispatch path and cannot be overridden, including by admins.
  • Demo/training accounts are firewalled from all real side-effects (approvals, releases, emails, integrations).

2 · Authentication & sessions

  • Passwords are hashed and managed by Supabase Auth (never stored by Porto MD in plain text). Branded self-service password reset is live.
  • Two-factor authentication (emailed 6-digit code) is required on every admin-tier sign-in. Codes expire in 10 minutes; 5 attempts maximum; resend is throttled.
  • Sessions hard-expire after 12 hours. Admin and provider screens auto-lock after 30 minutes of inactivity (with a 60-second warning), ending the session server-side.
  • Break-glass: if the email provider is down, the owner can set ADMIN_MFA_DISABLED=true in the hosting environment to temporarily bypass 2FA, and must re-enable it after.

3 · Encryption

  • In transit: all traffic is HTTPS/TLS — site, portals, APIs, and webhooks.
  • At rest: the database and file storage are encrypted at rest by our infrastructure provider (Supabase).
  • Outbound supplier webhooks are HMAC-signed so receivers can verify authenticity; inbound supplier APIs require per-supplier keys.
  • Secrets (API keys, credentials) are entered only in the encrypted portal, stored server-side, never emailed, never sent to browsers, never in public forms.

4 · Audit & monitoring

  • audit_logs records logins, 2FA events, approvals, releases, publishes, and other sensitive actions with actor, action, and timestamp.
  • integration_logs records every supplier data exchange (order pushes, tests, retries, failures) for troubleshooting and evidence.
  • Automated alerts: the team is notified on new applications, stuck orders, and permanently failed supplier deliveries (hourly sweep).

5 · Backups & retention

  • Database: automated daily backups by Supabase on our plan; retention per plan tier. Point-in-time recovery is enabled when the plan supports it.
  • Restore test: at least once per quarter, restore a backup to a scratch project and verify core tables (orders, products, applications) — record the date and result in Corp Documents.
  • Records retention: order, prescription-review, and audit records are retained a minimum of 6 years. That is Porto MD's policy: HIPAA's six-year period covers its required compliance documentation, not medical or order records, whose retention periods come from state and other law (the longer period applies). We do not purge clinical-adjacent records earlier.
  • Data disposal: when a partner relationship ends, their access is revoked immediately; data removal requests are honored within 30 days where no legal retention applies.

6 · Email & messaging hygiene

  • No PHI in emails or texts: customer notifications say an update exists and link to sign-in. Consumer/patient shipment emails never include product names; clinic (B2B) work orders may include items.
  • Passwords, API keys, and banking details are never requested or accepted over email — portal only. Team members must refuse and report any such request (it's either a mistake or phishing).

7 · Incident & breach response

  • Suspect something? (odd login alerts, missing data, a leaked credential): immediately tell the Security Officer, rotate the affected credential, and do not delete anything — evidence matters.
  • Contain: disable the affected account/integration (admin can pause any supplier method or user in minutes).
  • Assess: what data, whose, how many people, over what window — using audit_logs / integration_logs.
  • Notify: if unsecured PHI was breached and Porto MD holds it as a clinic's business associate, we notify that clinic (the covered entity) without unreasonable delay and no later than 60 days after discovery; the clinic notifies the affected individuals (within 60 days of discovery) unless it has delegated that to us in writing. HHS is notified alongside the individuals when 500 or more people are affected, and otherwise in the annual report of smaller breaches; the media is notified when more than 500 residents of one state or jurisdiction are affected. Engage counsel before external statements.
  • Record: every incident, even a near-miss, gets a short written post-mortem filed in Corp Documents.

8 · Responsibilities

  • Privacy Officer & Security Officer: the CEO (until formally delegated in writing).
  • Every workforce member with data access completes HIPAA training annually (Porto MD Academy) — completion records are retained.
  • Vendors that store or transmit PHI must have a signed BAA before PHI flows: database/hosting, email, SMS, and telehealth-video providers. The signed BAAs are filed in Corp Documents.

Owner: Security Officer · Review: quarterly, and after any incident · Companion: SOP-INT-004 (Supplier Onboarding), public HIPAA & BAA statement at /hipaa.

SOP-SEC-001 · Internal reference — not legal advice; counsel reviews before external representations of compliance.