Security that’s shipped, not promised.

What’s shipped

PHI-free by design

There are no patient fields anywhere in RepOrbit — no names, no identifiers, no imaging. Notes are scrubbed for identifiers before they’re indexed for AI retrieval, and Bill Only photos open in an on-device black-out tool that strips location and camera metadata before they upload. The safest patient data is the data that never enters the system.

Multi-factor authentication

Any account can enroll an authenticator app. Once a factor is verified, sessions that don’t present it don’t get in — the check runs in middleware on every request, not just at sign-in.

Row-level security on every table

Every table enforces ownership at the database layer, below the application. Sharing is written through audited database functions only, and every grant a teammate receives is read-only.

An enforced Content-Security-Policy

Enforcing since August 2026 — not report-only. Scripts, connections, and embeds outside the allowlist are blocked by the browser itself.

Rate-limited AI

The chat endpoint is rate-limited per user at the database, so the limit holds across every server instance — protection that doesn’t reset on a cold start.

Calendar sync that reads first

Google, Outlook, and Apple connections import your schedule; nothing writes back without an explicit action from you. A busy-only mode syncs your availability without event details.

Encrypted in transit and at rest

TLS everywhere; data encrypted at rest on Supabase’s managed Postgres.

No training on your data

Caddie runs on Anthropic’s API under terms that exclude customer data from model training. We don’t train models on your data either — the product gets better by organizing your knowledge, not by absorbing it.

Public links that can’t overshare

A shared document link serves only the snapshot you explicitly published — the working draft is structurally out of its reach, by database design, not by application logic. Links are unguessable and revocable in one tap, and the anonymous path was probe-tested against draft leaks and revoked access.

Your data is portable — self-serve

Profile → “Export my data” hands you one download: every table you own as JSON — plus a CSV of each one that reads as a table — your attachments as a time-limited signed manifest, and a MANIFEST.md stating the honest scope, including what was redacted. No ticket, no waiting. Permanent deletion is available on request today, self-serve at commercial launch.

Questions we haven’t answered here? Ask — the fastest way to make this page longer is to ask something it should already cover.