Security and reporting a vulnerability

What MediSync does

MediSync encrypts all connections with TLS and stores recordings and documents encrypted. Access to the infrastructure is restricted and logged. Technical and organisational measures has the full list.

What you can do

• Use a password of your own that you do not use anywhere else.
• Do not share your account. Every person on the team needs their own account.
• Do not send patient data by email or to support.

Report a vulnerability

Write to security@medisync.me. Do not use support, so the vulnerability does not become public before it is fixed.

Include in your report:

• where the vulnerability is, for example the address, interface or application,
• how to reproduce it, step by step,
• what an attacker could achieve with it,
• when you noticed it.

Do not include credentials or patient data. Test only with your own account and your own test data. Load tests, social engineering and automated scans against production are not allowed.

MediSync confirms receipt, reviews the report and keeps you updated until the vulnerability is fixed. There is no paid bug bounty programme. The full rules are at docs.medisync.me/security.