Infrastructure
- Hosting: Netlify CDN with global edge nodes and automatic HTTPS
- Database: Supabase (PostgreSQL) with encrypted storage at rest and in transit
- Payments: Stripe — EDNA never stores payment card data
- Email: Resend on dedicated subdomain (mail.ednaknows.com)
Authentication
- Magic link and password-based authentication via Supabase Auth
- All sessions secured with JWT tokens with automatic expiry
- Passwords hashed using bcrypt — never stored in plaintext
- Row-Level Security (RLS) enforced on all database tables — users can only access their own data
Data Protection
- All data encrypted in transit via TLS 1.2+
- Credential documents stored in encrypted object storage with signed URL access
- DEA numbers masked in employer views — never exposed to unauthorized parties
- Employer cross-visibility blocked by design — employers cannot see your activity at other facilities
Data Protection
Provider data is encrypted in transit and at rest, and access is role-based:
- Access controls
- Minimum necessary data exposure principles
- If your organization needs a Business Associate Agreement, contact us
- We will notify affected users of any data breach as required by law.
Monitoring & Incident Response
- Automated OIG/SAM.gov screening runs monthly
- Security incidents disclosed to affected users as required by law.
Responsible Disclosure
If you discover a security vulnerability in EDNA, please report it to security@ednaknows.com. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly.
Questions about security or to request a BAA: security@ednaknows.com