How we protect the data you entrust to us. Every layer of the infrastructure, explained clearly — authentication, transmission, isolation, device, storage.
Security isn't a single measure: it's a set of independent layers that reinforce each other. If one fails, the others keep protecting. Here's what we've built.
Authentication is the first gate. That's why we didn't build it in-house: we use Firebase Authentication, Google's platform that handles billions of logins daily and defines industry standards.
Every byte traveling between your device and our servers passes through an HTTPS connection with modern TLS. No exceptions, no fallback to HTTP. Man-in-the-middle interceptions don't stand a chance.
oralsnap.comEven if someone tried to request another user's data, the server rejects the request at the code level. Every query is anchored to your identifier, verified on each call.
Oralsnap's primary backend (database and clinical image storage) is hosted on servers in Germany. Backups in France. All within the European Union, under full GDPR protection.
Every file you upload is validated before touching the disk. Type, size, name — all checked. Original names are never kept: each file receives a new unique and unpredictable name, preventing path traversal attacks.
jpg, jpeg, png, gif, webpuniqid + timestamp, never the original nameFILTER_VALIDATE_EMAILEven if someone gets their hands on your unlocked device, the app won't open without Face ID, Touch ID or local PIN. All verification is handled by the operating system: biometric data never travels to our servers, we don't even receive it.
Even if someone found a lost or stolen NFC tag of yours, they couldn't extract any sensitive information from it. On the tag there's only a URL — no names, no images, no diagnoses. Data security stays on our protected servers.
Security isn't done "at the end". It starts from how we write code, how we isolate environments, how we handle errors. Here are the practices we apply every day.
When you delete your account, we actually delete everything. No hidden data, no "soft delete" that leaves shadows in the databases. The deletion happens in an atomic transaction: it either succeeds completely, or doesn't happen.
A quick summary for those who want the complete picture at a glance. Each entry corresponds to a layer described in detail above.
If you suspect a security issue, a vulnerability, or simply want to ask us a technical question, write to us. We don't take legal action against those who report in good faith.