Security Practices
Security is not a feature. It's the architecture.
A comprehensive overview of how GGHealth protects healthcare data at every layer — from encryption to infrastructure.
Last updated: May 24, 2026
Encryption
AES-256-GCMAt rest
All personal health information is encrypted at the field level using AES-256-GCM before storage. Each field uses a unique initialisation vector (IV), ensuring that even identical values produce different ciphertext.
In transit
All communications between clients and our servers use TLS 1.3, the most current version of Transport Layer Security. Older protocol versions (TLS 1.0, 1.1, 1.2) are disabled.
Key management
Encryption keys are stored in Azure Key Vault with hardware security module (HSM) backing. Keys are automatically rotated on a scheduled basis and are never stored alongside encrypted data.
Cryptographic erasure
When data reaches the end of its retention period, we destroy the associated encryption keys, rendering the data permanently unrecoverable — even if storage media is not physically destroyed.
Authentication
MFA RequiredMulti-factor authentication
MFA is mandatory for all accounts that access patient data. We support time-based one-time passwords (TOTP) and authenticator apps. No exceptions, no bypass.
Password policy
Passwords must be a minimum of 12 characters and include uppercase letters, lowercase letters, numbers, and special characters. Common and breached passwords are rejected automatically.
Session management
Sessions are managed through secure, HttpOnly cookies with strict SameSite policies. Sessions expire after a configurable idle timeout and are invalidated on logout. Concurrent sessions are monitored.
Brute-force protection
Accounts are temporarily locked after repeated failed login attempts. Rate limiting is applied to all authentication endpoints. Suspicious login patterns trigger automated alerts.
Access Control
RBAC + LockboxRole-based access (RBAC)
Six predefined roles — Administrator, Physician, Midwife, Nurse, Pharmacist, and Allied Health — each with granular permissions. Administrators manage the system but cannot access patient clinical data.
Circle of care
PHI access is restricted to providers within the patient's circle of care, as defined by PHIPA. Circle membership is verified programmatically before every data retrieval.
Lockbox restrictions
Patients can designate sensitive information as lockbox-protected. Lockbox records are withheld from all providers — even those within the circle of care — unless the patient provides explicit written consent.
Break-glass access
In genuine emergencies, authorised providers (Physicians and Midwives) may invoke break-glass access to lockbox records. Every break-glass event is logged with full context, flagged for review, and included in audit reports.
Audit Logging
Tamper-EvidentComprehensive logging
Every data access, modification, export, and deletion is logged with who, what, when, where (IP/device), and why. Audit records are immutable once written.
Tamper-evident hash chain
Each audit entry is cryptographically linked to the previous entry via SHA-256 hashing, forming a verifiable chain. Any attempt to alter or delete a log entry breaks the chain and triggers an alert.
Daily verification
Automated daily integrity checks verify the hash chain across all audit records. Any inconsistency is flagged immediately for investigation.
Patient access reports
Patients may request a full audit report showing exactly who accessed their information and when — a right guaranteed under PHIPA.
Infrastructure
Azure CanadaAzure Canada Central
All GGHealth infrastructure runs exclusively in Microsoft Azure's Canada Central region (Ontario). This includes compute, storage, databases, key vaults, and all supporting services.
Azure Key Vault
All encryption keys, secrets, and certificates are stored in Azure Key Vault with HSM-backed protection. Access to Key Vault is restricted to application identities with least-privilege permissions.
Network isolation
Databases and internal services are deployed within private virtual networks with no direct internet exposure. All external traffic routes through managed ingress controllers with WAF protection.
Automated backups
Database backups run automatically with point-in-time recovery capability. Backups are encrypted and stored in geographically redundant storage within Canada.
Incident Response
Real-TimeBreach detection
Real-time anomaly detection monitors access patterns, data volumes, and user behaviour. Unusual activity triggers immediate automated alerts to our security team.
IPC notification
In the event of a confirmed breach involving PHI, we follow PHIPA's mandatory breach notification process — notifying the Information and Privacy Commissioner of Ontario and affected individuals promptly.
Incident response plan
We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident analysis. The plan is reviewed and tested regularly.
Post-incident review
Every security incident, regardless of severity, undergoes a thorough post-incident review. Findings are documented and used to strengthen preventive controls.
Data Residency
Canada PrimaryCanadian infrastructure
All patient data, provider data, backups, logs, and encryption keys are stored exclusively within Microsoft Azure Canada Central. Database storage, key vaults, and application hosting never leave Canadian borders.
AI processing transparency
When configured with Azure OpenAI Service (Canada Central), audio transcription processing remains within Canada. Call summarisation uses Anthropic Claude (US-based); only de-identified transcript text is sent — no patient names, health card numbers, or contact details. We are actively evaluating Canadian-hosted alternatives for all AI services. Full details are disclosed in our Privacy Policy under "Third-Party AI Processors."
Contractual guarantees
Our infrastructure agreements with Microsoft Azure contractually guarantee that stored data remains within Canadian data centres and is subject to Canadian law. AI processing services are governed by separate data processing agreements that prohibit use of transmitted data for model training.
Vulnerability Management
AutomatedAutomated scanning
Continuous automated vulnerability scanning across our codebase, dependencies, and infrastructure. Known vulnerabilities are prioritised and patched based on severity.
CodeQL analysis
Static code analysis via GitHub CodeQL runs on every code change, catching security issues before they reach production. Critical findings block deployment.
Dependency monitoring
Automated dependency monitoring identifies vulnerable packages and generates update recommendations. Critical dependency vulnerabilities are addressed within 24 hours.
Responsible disclosure
We welcome responsible disclosure of security vulnerabilities. If you discover a potential issue, please report it to security@giftofgab.ai. We commit to acknowledging reports within 24 hours.
Report a Vulnerability
We take security seriously and welcome responsible disclosure. If you discover a potential vulnerability, please report it promptly.
security@giftofgab.ai