The full security overview.
The deep technical detail — infrastructure, retention, encryption, recovery, and audit. Built so the families we serve, and the organizations behind them, can verify exactly how their information is handled.
AWS HIPAA BAA
Plan data sits in AWS RDS Postgres, encrypted at rest with managed keys. Every Lambda has its own IAM role. The legal agreement that lets hospitals run on AWS is signed, in force, for Eleplan.
OpenAI Zero-Data-Retention
Our agreement with OpenAI says zero retention. Your voice turns, your chat, your memory — none of it sits on a model-vendor server or feeds a future training set. It belongs to your plan.
End-to-end encrypted Vault
Insurance cards, Medicare numbers, pharmacy logins, PINs, advance-directive details: encrypted on the device before sync. We literally cannot read them. Recoverable from a recovery phrase only you hold.
Passwordless authentication
Face ID and Touch ID instead of passwords. App Attest validates the iOS binary itself, so a stolen credential can’t be used from unfamiliar hardware. Signed JWT on every endpoint.
Secrets in managed vaults
API keys, signing keys, and per-stage credentials live in audited cloud vaults. They never touch a developer laptop. Every read is logged by principal, end to end.
Sovereign snapshots & audit logs
Point-in-time backups of the whole plan, encrypted again before sync. Every share is permission-based, time-boxed, and revocable — with an audit trail of who accessed what.
There are absolutely people who want this level of detail — and we’re glad to give it to them: