Security

How your data is protected

• Encryption in transit. All traffic is served over HTTPS. Browser requests that arrive on an alias hostname are permanently redirected to https://app.ginivo.ai.
• Encryption of stored credentials. Third-party credentials we hold for a clinic (Google refresh tokens, Instagram and Facebook page tokens, connected booking-system credentials) are encrypted at rest with AES-256-GCM. The encryption key lives in the hosting platform's environment configuration, not in the code.
• Signed webhooks. Inbound webhooks from Twilio and Meta must carry a valid HMAC signature. Requests that fail the check are rejected.
• Database transport. Every connection to the database requires TLS.

Infrastructure

• Application: hosted on Vercel.
• Database: Neon Postgres, with TLS required on every connection.
• SMS: sent through Twilio under a verified A2P messaging campaign.
• The full set of infrastructure providers we share data with, and why, is listed in our Privacy Policy.

Access and isolation

• Tenant isolation. Each clinic is a separate tenant. For a signed-in request, the tenant is resolved on the server from the session, never from anything the client sends. One clinic cannot address another clinic's data.
• Authentication. Sign-in and sessions are handled by Better Auth.
• Google Calendar. Access uses two narrow scopes: reading busy and free intervals, and managing only the events Ginivo itself creates. The app has passed Google's OAuth verification for these scopes.
• Careful rollout. New features ship behind flags that are off by default and fail closed: an unset or malformed flag means off, for every clinic.

What we do not claim

We hold no third-party certifications yet. No SOC 2, no ISO 27001, no HIPAA certification. Ginivo is an early-stage product built by a small team, and we would rather say that plainly than imply a badge we do not have. If your review needs more detail than this page, email team@ginivo.ai and we will walk you through how any part of the system works.

Data deletion

A clinic can request deletion of its data at any time, and end clients can request deletion of theirs. See our Data Deletion instructions or email privacy@ginivo.ai. We confirm deletion within 30 days.

Reporting a security concern

If you believe you have found a vulnerability, email team@ginivo.ai with steps to reproduce. We read and answer every report.