Security overview

TriageFit is a health coaching service, so the data it holds is sensitive by nature and the platform is built on that assumption. This page describes the controls as they run in production, in the order a procurement reader usually asks about them. It pairs with the data-flow summary, the sub-processor list and the data processing agreement.

Where data is processed

Processing is kept in the EU wherever we control the region. Application compute is pinned to Frankfurt, the database runs in Frankfurt, member file uploads are stored under EU jurisdiction, error monitoring runs in Germany, and AI requests run in EU regions only, with a runtime check that refuses to start a request against a non-EU region. The sub-processor list states the position per provider, including the global providers, such as the payment and email carriers, where no single region is pinned.

Encryption

All traffic to and from the Service runs over TLS. On top of the platform's storage encryption, sensitive health fields are encrypted at the application layer with AES-256-GCM before they reach the database, so a database-level compromise on its own does not expose their contents. Database backups are taken on a schedule and encrypted with a public key whose private half is held offline, outside the systems that write the backups.

What an employer can and cannot see

Organisation reporting is aggregate by design and enforced in the data engine rather than in the screen. A metric is released only when at least five distinct members contributed to it; below that floor the engine returns a suppressed value that carries no number at all, and the report says why. No organisation role can reach an individual member's logs, messages or health data through any route. What an organisation admin does see is the roster: who was invited, whether the invitation was redeemed, and each seat's state.

Access control and auditing

Every API route that reads member data checks both who is signed in and whether that account is entitled to the specific record it asks for, so one member, coach or organisation admin cannot reach another's data by changing an identifier. Reads of special-category health records by staff write to a dedicated sensitive-read audit trail recording who read what and when.

Account security

Passwords are stored only as salted hashes under an industry-standard adaptive algorithm, and new passwords are screened against known breach corpuses. Members and organisation admins can turn on two-factor authentication with an authenticator app. Authentication and other sensitive endpoints are rate limited.

Payments

Payment is handled by Stripe. Card and bank details are entered with Stripe and never touch or rest on TriageFit's servers; we hold billing references, not payment instruments.

Monitoring without leaking

Error telemetry is scrubbed of known identifying and health fields before it leaves the application, and session replay is disabled, so the monitoring pipeline cannot become a copy of member data.

Software supply chain

Dependencies are installed under a minimum-release-age policy, so a freshly published package version cannot enter a build for several days, and a standing scanner checks the dependency tree for known compromised packages.

Data rights and incident response

Members can export their data and erase their account from inside the product, and consent is versioned and audited. We maintain an internal breach-response runbook, and our Data Protection Officer is named in the privacy policy. The Irish Data Protection Commission is our lead supervisory authority.

Questions and disclosures

Security questions, diligence questionnaires and vulnerability reports all reach us at info@triagemethod.com. If you believe you have found a vulnerability, tell us there before telling anyone else and we will respond quickly and without legal threat for good-faith research.