Security

Security at MedPayHub

Medical bills are among the most sensitive data a person can share. We treat protecting that data as a core product requirement, not an afterthought. This page describes the controls we operate today and the standards we are working toward. We will keep it current as the product matures.

Current status

MedPayHub is pre-launch. During the waitlist period we do not collect or store medical records, bills, or other protected health information (PHI) — only the contact details you voluntarily provide. The protections below describe how the platform is built to handle your data once bill upload and analysis go live.

Encryption

• In transit: all traffic is served over HTTPS (TLS 1.2+), with HSTS enforced so browsers only ever connect over a secure channel.
• At rest: data stored in our managed database and file storage is encrypted at rest using AES-256.

Access controls

• Row-level security isolates each account's data so users can only ever access their own records.
• Internal access follows the principle of least privilege. Sensitive credentials and service keys are stored as encrypted secrets and are never exposed to the browser.
• Application and administrative access requires authentication, and access to production systems is restricted to the minimum set of people required to operate the service.

Infrastructure

MedPayHub runs on established, independently audited cloud providers (our hosting and managed database/storage providers are themselves SOC 2 certified and run on AWS infrastructure in the United States). We add application-level hardening on top, including per-IP rate limiting on sensitive endpoints and strict security response headers (HSTS, a restrictive Permissions-Policy, and related protections).

Payments

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Card details are sent directly to Stripe and are never stored on MedPayHub servers.

AI processing

Some features use AI to read and analyze the bills you choose to upload. AI processing happens server-side over encrypted connections, and content you submit is not used to train third-party models.

HIPAA & Business Associate Agreements

MedPayHub is built around the administrative, physical, and technical safeguards expected for handling PHI. Where our infrastructure partners process PHI on our behalf, we execute Business Associate Agreements (BAAs) with them as required. See our HIPAA Notice for details. Enterprise customers (employers, TPAs, brokers) can contact us about BAA availability for their deployment.

Compliance roadmap

A SOC 2 Type II examination is on our roadmap as we approach launch and onboard enterprise customers. We will publish our certification status here once an audit is underway and completed — we do not claim certifications we have not earned.

Responsible disclosure

If you believe you have found a security vulnerability, please report it to security@medpayhub.com. We appreciate responsible disclosure and will work with you to investigate and resolve valid reports promptly. Please do not access or modify data that is not yours, and give us a reasonable window to remediate before any public disclosure.

Questions

For general security or privacy questions, contact privacy@medpayhub.com.