Security
Patient data deserves care
Here is what Meridova does today, in plain words, with a way to check each point. For the full picture and what is still being built, read our compliance page.
What we do
Access control
Every person has a role. Screens and actions they cannot use do not appear, and the server refuses them even if someone types the address.
How to check: Ask for a demo of the roles screen.
Package-aware
Products you have not bought are not just hidden; the server blocks them.
How to check: Visible in Plan and billing.
Audit trail
Changes are logged with who and when. Reads of a patient’s record are logged too.
How to check: Open the Audit log screen.
Safe sign-in
Strong password rules, lockout after repeated failures, sessions that expire, and automatic sign-out on idle workstations.
How to check: Try five wrong passwords on a test account.
Two-step verification
Available for accounts, and required for our own platform staff.
How to check: Settings, Profile.
Separate hospitals
Every query is limited to your hospital, and tests try to read one hospital’s data from another. Database-level row security is planned as a second layer.
How to check: We can share how this is tested.
Support you can see
When our team needs to look at your workspace, it happens in a logged support session, and your administrators are told.
How to check: Support sessions appear in your audit log.
Protected transport and storage
Traffic uses HTTPS with strict security headers. Sensitive secrets such as two-step keys are encrypted.
How to check: Check the headers in your browser.
Safe retries
Money, stock and order actions are protected against double clicks and retries.
How to check: Try submitting the same payment twice.
Questions about security?
Ask us for the security details your organisation needs.