Security

Designed for a healthcare-data hosting perimeter.

HairSim does not claim HDS certification, GDPR certification, or medical-device status. Using an HDS-capable host does not make the full application certified.

• Private buckets, opaque storage keys, short-lived signed URLs. Never permanent public media URLs.
• Object-level authorization and tenant isolation on API routes. Possession of an ID is not access.
• Platform admin consoles expose metadata and aggregates, not patient photographs or full PII.
• Audit logs record who / what / which resource — without duplicating the clinical record.
• Stripe webhooks verify signatures. Browser-reported payment success is never trusted.
• Development authentication and development AI providers are refused at production startup.