Security

In transit

All traffic is served over TLS. Certificates are managed by our hosting layer and rotated automatically.

At rest

Sensitive fields (phone, email, assessment inputs) are stored in an encrypted database with row-level access controls that scope reads to the doctor you selected.

Form protection

Public forms use OTP verification, rate limiting keyed by hashed IP, and Zod schema validation on the server. Bot traffic is filtered.

Secrets

API keys and service credentials are never committed to source control. They live in the platform secret store and rotate on a schedule.

Reporting a vulnerability

Email security@goinvisalign.in. We'll acknowledge within 3 working days.