Security

Data isolation. Every health record carries your user id and is protected by row-level security in the database. One user can never read another user's records — this is enforced by the database itself, not just application code.

Encryption. All traffic is encrypted in transit (TLS) and data is encrypted at rest.

Authentication. Email/password with leaked-password protection available, plus Google sign-in. Sessions expire; password reset is supported. Multi-factor authentication is on the architecture roadmap.

Audit logging. Security-relevant events (data exports, report sharing, account deletion, subscription changes) are recorded in an audit trail visible only to you.

Sharing. Shared report links use unguessable tokens, always have an expiry date, and can be revoked instantly.

Compliance note. Soluna is architected with Canadian and U.S. health-privacy expectations in mind, but we do not claim HIPAA, PIPEDA, or SOC 2 certification until the required legal, technical, and audit processes are genuinely complete.