Security
How accounts, access and data are protected, stated as what the platform does today.
- Single sign-on
- Google Workspace, Microsoft Entra ID
- Passwords
- Stored only as bcrypt hashes
- Two-step
- Authenticator app; can be required
- Idle sign-out
- 30 minutes
- Patient fields
- Encrypted; every look logged
- Releases
- 280+ test files first
Signing in
Single sign-on
Staff can sign in with Google Workspace or Microsoft Entra ID, so your organization's own account controls and offboarding apply. Type a work email address on the sign-in page and it offers that organization's sign-in. The answer depends only on the part after the @, so it reveals nothing about who has an account.
Passwords, hashed
Passwords are stored only as bcrypt hashes. They need eight characters with an uppercase letter, a number and a symbol, cannot contain the person's name, and cannot repeat any of the last three.
Password resets by link
Password resets go by single-use email link that expires in 30 minutes. Asking for one says the same thing whether or not an account matches, and choosing the new password signs the account out everywhere else. Someone with no email on file is reset by their administrator, who sets a temporary password they must change at the next sign-in.
Lockout on guessing
Repeated failed sign-ins lock the attempt out: eight failures on one account from one address, twenty-five on one account from anywhere, or fifty from one address, within fifteen minutes.
Two-step sign-in
Anyone who signs in with a password can add a six-digit code from an authenticator app, with ten single-use recovery codes for a lost phone. An organization can require it of everyone. Work-account sign-ins use the workspace's own second step.
Sessions and access
Sessions you control
The session cookie cannot be read by scripts, travels only over secure connections and ends when the browser closes. Active sessions can be listed and revoked.
Sign-out when idle
Clinic computers are shared, so a session ends after 30 minutes without activity. A warning appears two minutes ahead, and activity in any open tab counts.
Least access
Four roles, from learner to administrator. Supervisors see only the teams they supervise, and every organization is walled off from every other.
A record of changes
Administrative actions are written to an audit log with who did it and from where. When support staff view the platform as a user to help them, that is recorded too.
Data
Patient data in one protected place
The platform trains staff and asks for patient information in one place only: the patient fields on an incident report. They are kept apart from the report and encrypted, only administrators and the incident's investigators can open them, every look is logged, and they never go into an email, an export or a printout.
Contracts behind the sign-in
Policy documents and vendor contracts, BAAs included, are uploaded as PDFs and kept in the platform's own database. They open only inside the signed-in platform, for the people allowed to see them (a vendor contract for that organization's administrators alone), never from a public link.
Deletion that finishes
A deleted account is removed permanently after 14 days, and an organization that leaves can have all of its data removed.
The platform
Locked-down pages
Every page is served over HTTPS only, with a content security policy that names each outside service a page may load. Other sites cannot frame the platform, and nothing records sessions.
Verified releases
Every release runs more than 280 automated test files first. After upload, the release checks the size of every program file on the live server against what was built, and fails if one does not match. The study content, which the content editor changes on the server, is compared and reported rather than enforced.
Found a security issue? Tell us at info@ophthalmicacademy.com and we will respond promptly.