Security

Security at Sanctum

Last updated: November 2026

Sanctum holds health information for holistic practitioners and their patients. This page sets out how we protect it, including what is not in place yet.

Keeping practices apart

• Each practice's data is kept separate at two levels: in the application, and in the database with row-level security.
• Each practice has its own encryption key, managed in AWS KMS.
• Automated tests check this separation on code changes and every night.

Access inside a practice

• Two-step login is required by default.
• A practitioner's full patient records and clinical notes are limited to their own patients and the practice owner.
• Other team members see only name, contact details, allergies and medications, and a colleague's calendar shows only times.
• Patient record views, document downloads, exports, deletions and administrator access are kept in an append-only log.

Protecting data

• Clinical notes, medical details and stored credentials are encrypted field by field, on top of encryption at rest. All traffic uses TLS 1.2 or higher.
• Backups run nightly, are encrypted, and cannot be altered or deleted for 90 days.
• AI features run on AWS in the EU. Your patient data is never used to train AI models.
• Our suppliers and where they process data are listed on our sub-processors page.

How we build and release

• Every code change runs automated security scans, dependency checks and a scan for leaked credentials.
• Production releases are built automatically and cryptographically signed.
• Production has its own uptime monitoring and alerts.

What is not in place yet

• We are arranging an independent penetration test. It has not happened yet.
• We do not currently hold ISO 27001, SOC 2 or Cyber Essentials certification.

We will update this page as these change.

Reporting a security problem

If you think you have found a vulnerability, please email [email protected] with "Security" in the subject, and include enough detail for us to reproduce it.

• We will acknowledge your report within 5 working days and tell you what we plan to do.
• We will not take legal action against anyone who follows this policy in good faith.
• Please do not access, change or keep other people's data. If you come across any, stop and tell us.
• Please do not disrupt the service, use social engineering, or share the problem publicly until we have fixed it.

We do not currently pay rewards for reports.