Security, in plain words

Only the people the circle's Owner has invited, at the level they were given: Owner, Collaborator, Contributor or Viewer. Every action is checked on our server against that role — the browser is never trusted to decide what it may change. A helper's seat sees the day's visits and tasks and nothing else: no bills, no documents, no family notes. Nobody outside the circle can see it, and our own team does not read care data as a matter of course.

Passwords are stored only as a salted scrypt hash; we never see or keep the password itself. Sessions are signed tokens tied to the account and to a version number, so changing a password or closing an account ends every session at once. Sign-in attempts are rate-limited. Password-reset links last an hour, verification links a day, and a reset request never reveals whether an address has an account.

Sign in with Google or Yahoo uses the standard authorization flow with a one-time code and, for Google, proof-key exchange. An address that already has a password account is never merged automatically — you sign in with the password once and the link is made then. Profile photos from either provider are not stored.

A document you upload is read by one AI provider, Anthropic, and by no other — the list is enforced in code, not in a policy, and our build fails if it changes. Nothing that is read joins the plan until a person in the family approves it. Kora, the assistant on the public website, has no access to any circle at all.

If you connect a patient portal, we hold a read-only token for exactly the sections you chose, encrypted (AES-256-GCM) on our servers. It is never sent to the browser or to an AI provider, we never see the portal password, and disconnecting deletes the token. Data from a portal is never sent for AI extraction.

The circle is stored on a persistent disk on servers we operate in the United States. A dated snapshot is written once a day and kept for fourteen days, and the whole store is periodically copied to storage off the same host, sealed before it leaves. Traffic is HTTPS only, with strict transport security so a browser never falls back to plain http after its first visit.

Every page is served under a content-security policy. Inside the command center it allows nothing but our own origin — no third-party scripts, images or connections at all. The public marketing pages allow one exception, Meta's measurement pixel, and it cannot load anywhere care information is on screen. Pages cannot be framed by other sites, and signing out tells the browser to drop anything it cached.

Honesty is part of the design, so: there is no two-factor sign-in yet. The backup copy is periodic, not a continuously mirrored database. This policy and the privacy policy have not yet been reviewed by counsel; they will be before KoraCommand accepts payment. No system is perfectly secure — if we ever discover a breach affecting your information, we will tell affected families promptly and plainly, with what happened and what to do.

Found something? Email [email protected] with what you saw. A real person reads it, and we would rather hear about a weakness from you than from anyone else.