How DocBase protects
patient data.
Patient data is governed by India's DPDP Act 2023. DocBase implements the operational controls that Act requires - consent, erasure, retention and audit - and keeps every clinic's records separate from every other clinic's.
Protected at every layer
Stored credentials
Data in transit
Clinic isolation
Data deletion
Built secure, end to end
Server-side sessions
Random 32-byte tokens in httpOnly cookies. The server keeps only a SHA-256 hash.
Rate limiting
Login, password-reset and OTP endpoints are rate limited to slow brute-force attempts.
Input validation
Requests are checked against schemas, and every database query is parameterised.
Strong passwords
Complexity rules are enforced every time a password is set.
Audit logging on patient data access
Reads and writes to patient records are logged with who, what and when.
CSRF protection
Double-submit cookie pattern prevents cross-site attacks.
Security questions
Every page and API call is served over HTTPS, and in production DocBase sends a Strict-Transport-Security header so browsers refuse plain HTTP. Responses also carry a Content Security Policy and headers that block clickjacking and MIME sniffing.
Questions about your data?
Ask us how DocBase handles your patients' records before you sign up.