Trust before novelty.

Role capabilities are enforced by Postgres row-level security, not by hidden buttons. A household member cannot promote themselves. Pending invitations are visible only to owners/admins, invitation credentials are stored as hashes, and acceptance requires the signed-in email to match the invited email. Cross-household access still resolves through active membership.

Last verified: July 20, 2026

New bearer links are shown once and only a SHA-256 hash is retained. Resolution checks the hash, expiration, revocation, a strict resource-specific field allowlist, and a per-token access limit. Valid accesses increment the link view count and enter a limited 180-day access audit. Underlying account tables have no anonymous read policy, and bearer credentials and hashes are excluded from account exports.

Last verified: July 20, 2026

Every request is authenticated, limited, and scoped to one pet. Database policies filter context before it reaches the model. Record text is treated as untrusted data rather than instructions. Model calls time out, output is validated, and a failed upstream request releases the reserved monthly allowance instead of charging it. Document extraction remains an unreviewed draft until the owner approves it, and original files are not modified.

Last verified: July 20, 2026

Database triggers derive the pet from the routine or medication instead of trusting a submitted pet ID. Household timezone determines occurrence date and late status. Care-history updates are restricted to auditable void metadata. Medication doses snapshot active instructions and decrement inventory atomically, so concurrent caregivers cannot overwrite the count.

Last verified: July 20, 2026

The application accepts supported images and PDFs up to 15 MB, generates the private storage path on the server, and validates the stored object's size, MIME signature, and SHA-256 checksum. Household-wide plan limits are reserved atomically so concurrent uploads cannot bypass them. Files remain in a private Supabase bucket behind household and role policies. Secrets stay server-side and are never shipped to the browser.

Last verified: July 20, 2026

Medical records should not be uploaded to an unrelated third-party scanner without a reviewed privacy agreement. A production scanner, quarantine state, failure policy, and retention agreement must be selected and verified before this item is marked live. Current controls reject unsupported or malformed files but are not a substitute for antivirus scanning.

Last verified: July 20, 2026

The JSON export includes a versioned manifest, per-dataset row counts, explicit exclusions, document metadata, and a SHA-256 payload checksum. It fails closed rather than silently creating a partial file when a required dataset cannot be read. Original document binaries remain in the private vault; a packaged binary archive is not yet claimed. Account deletion has a seven-day grace period, a typed confirmation, and a household-impact preview. Shared households transfer ownership and retain shared pet records with anonymized attribution; the final active member deletes the household.

Last verified: July 20, 2026

The database stores separate pending, processing, sent, delivered, failed, and suppressed states, plus provider correlation fields and privacy-safe founder operations. The application includes a signed Resend webhook endpoint and suppression schema. The currently active dispatcher still requires promotion to the tested version that checks suppression before send and persists provider message IDs, and the production Resend webhook registration must be verified before this section becomes fully live.

Last verified: July 20, 2026

We avoid vague claims such as “military-grade” or “bank-level.” Sensitive record contents are not placed in product analytics. Independent penetration testing, dedicated malware scanning, a packaged binary-file export, and verified provider-delivery webhooks remain unfinished and are named here rather than implied.

Last verified: July 20, 2026