Security at RareJourney

Encryption

Data at rest: AES-256 encryption

All data stored in our database (Supabase/AWS) is encrypted using AES-256, the same standard used by banks and government agencies. Your health records, documents, and personal information are encrypted before they're written to disk.

Data in transit: TLS 1.2+

All data transmitted between your device and our servers is protected by Transport Layer Security (TLS 1.2 or higher). This prevents interception or tampering during transmission.

File storage encryption

Uploaded documents (PDFs, images, medical records) are encrypted in Supabase Storage using AWS encryption standards before being stored.

Access Controls

Row-Level Security (RLS)

Every database query is automatically filtered to ensure you can only access your own data. Enforced at the database level, not just the application.

Per-user data isolation

Your health records are tied to your authenticated user ID. No other user — not even RareJourney staff — can access your data without explicit authorization.

Secure authentication

Email and password authentication via Supabase Auth with industry-standard password hashing (bcrypt).

Session management

Sessions expire automatically after inactivity. Secure token storage prevents unauthorized access even if a device is compromised.

Infrastructure Security

RareJourney runs on enterprise-grade cloud infrastructure with world-class security certifications:

Supabase (Database & Storage)

Hosted on AWS in Australia East. SOC 2 Type II and ISO 27001 certified. See subprocessors.

Microsoft Azure (AI Services)

Azure OpenAI Service hosted in Australia East. SOC 2 Type II, ISO 27001, and HIPAA eligible. Data residency enforced.

Network security

DDoS protection, Web Application Firewall (WAF), and network isolation provided by AWS and Azure infrastructure.

PII & Sensitive Data Handling

Automatic redaction during document processing

When you upload medical documents, our AI processing pipeline automatically identifies and handles personally identifiable information (PII) with care:

•Names, addresses, phone numbers, and medical record numbers are detected and redacted before data is sent to AI providers for analysis
•Original documents remain encrypted in storage, accessible only to you
•Only the minimum necessary context (anonymized excerpts) is sent to Azure OpenAI for AI companion responses

Operational Security

Execution log retention

System logs that may contain query traces or processing details are automatically purged within 72 hours to minimize data exposure.

Error monitoring

Error tracking (Sentry) scrubs all personal information before transmission. No health data appears in error logs.

Access logging

All administrative access to production systems is logged and monitored for security audits.

Regular security updates

Dependencies, libraries, and infrastructure are regularly updated to address known vulnerabilities.

Incident Response

Notifiable Data Breach (NDB) procedure

RareJourney maintains a documented incident response plan aligned with the OAIC's Notifiable Data Breaches scheme under the Privacy Act 1988:

1.Detection & containment: Security incidents are identified through automated monitoring and promptly contained.
2.Assessment: We assess whether the breach is likely to result in serious harm to affected individuals.
3.Notification: If required, we notify the OAIC and affected individuals as soon as practicable, including steps taken to mitigate harm.
4.Remediation: We implement additional security measures to prevent recurrence and document lessons learned.

Report a security concern

If you discover a security vulnerability or have concerns about our security practices, please contact us immediately. We take all reports seriously and respond promptly.

Contact Privacy Team