Security & responsible disclosure

Medical stores keep their whole sales history in MedStock, so we take security seriously and we describe it honestly: what we do, what we do not yet have, and how to tell us when you find a problem.

1. Found a vulnerability?

Please include steps to reproduce, the account or environment used, and any proof-of-concept. Encrypt sensitive details if you can; ask us for a key.

2. Scope and safe harbour

• In scope: healthsarthiai.com, medstock.in, app.medstock.in, the MedStock desktop and mobile apps, and our APIs.
• Test only against accounts you own. Do not access, change or delete other people's data; if you stumble on it, stop and report.
• No denial-of-service, spam, phishing of our users, or physical attacks.
• If you follow these rules and report in good faith, we will not take legal action against you and we will work with you, not against you.

3. What we do

• In transit: all traffic between apps, the website and our servers uses TLS.
• On devices: MedStock's local database is encrypted with SQLCipher; the key is held in the operating system's credential store.
• On servers: hosted in AWS Mumbai; storage and backups encrypted at rest; secrets kept in a managed secret store, never in code.
• Tenant isolation: every shop is a separate tenant and the database enforces row-level security, so a bug in application code cannot read across shops.
• Authentication: passwords are salted and hashed; sessions use short-lived signed tokens; staff accounts have role-based permissions checked on every API call.
• Change control: every schema change is a versioned migration reviewed before it ships; automated tests fail the build if an endpoint is left without an authorisation check.
• Audit trail: stock is an append-only ledger — nothing is edited in place, so every change stays traceable.

4. What we do not have yet

We are a small company and we would rather you know: we do not hold an ISO 27001, SOC 2 or HIPAA attestation, we have not yet commissioned an external penetration test, and we do not offer a contractual uptime SLA. These are on our roadmap as the network grows. We will update this page when each is done, and not before.

5. If something goes wrong

If we confirm a breach affecting your data, we notify affected account holders by email and in-app within 72 hours of confirming it, tell you what was affected and what we did, and notify the Data Protection Board of India as the DPDP Act requires.