Security

SAPHIR uses account authentication, session protections, privacy controls, access logs, QR visibility settings, anti-abuse controls and secure transport in the production environment.

Sensitive workflows are designed to reduce accidental exposure and to give users control over what is externally visible.

Account activity logs are available in the dashboard so that users can detect unrecognized access early.

Emergency QR access can make selected medical information available to anyone with a valid QR or access link.

Users should regularly review the QR status, expiry, shared sections and access history to keep exposure aligned with their needs.

QR codes can be renewed, deactivated or adjusted from the dashboard’s QR settings at any time.

SAPHIR supports sign-in with email and password, and also with Google or Apple accounts. Passwords are always stored using secure hashing, never in plain text.

Two-step verification adds an additional layer of protection to account access and is recommended on all profiles containing clinical information.

If you notice an unrecognized sign-in attempt, review the activity log in the dashboard and change your password immediately.

Use a strong, unique password and keep your associated email account secure.

Sign out on shared devices, review account activity and delete information that should no longer be available.

Do not share screenshots, QR codes, documents or access links with people who should not see your medical information.

SAPHIR applies encrypted communications over HTTPS in the production environment to protect data in transit between the browser and the server.

Stored data is subject to technical and organizational measures to prevent unauthorized access, loss or alteration.

Passwords are never stored in plain text; secure hashing is used in line with industry best practices.

SAPHIR has a security incident response process that includes identification, containment, impact assessment and notification of affected users where appropriate.

In the event of a significant security incident, affected users will be notified as required by applicable regulations and the circumstances of the incident.

If you believe you have found a vulnerability, an account compromise, exposed medical data or suspicious access, contact SAPHIR support immediately.

Include the steps to reproduce, the affected URLs, screenshots where it is safe to do so and the potential impact. Do not access, alter or disclose data of another user account.

SAPHIR values responsible disclosure and will review all security reports received through the official channel.

Fundación FSO is a non-profit organization dedicated to promoting security, privacy and good practices in the digital sphere.

SAPHIR benefits from the security standards and best practices promoted by Foundation FSO so that its users can protect their medical information against digital threats.

For more information on Foundation FSO’s security initiatives, visit its official website.