Sensitive by design, clear about the boundary.
Vaux Nutrition Practice uses workspace isolation, server-side permission checks, and least-privilege data access. It is not HIPAA compliant at launch.
Last reviewed: July 26, 2026
Workspace isolation
Supabase row-level security and server authorization keep each organization's records separate.
Access control
Server-side permission checks enforce least-privilege access on every request; nothing relies on client-side trust.
Encryption
Traffic is encrypted in transit with TLS, and stored data is encrypted at rest by our managed infrastructure providers.
Subprocessors
Supabase provides the database and authentication, Vercel provides hosting and marketing analytics, and Stripe processes payments.
Minimum necessary data
The product prohibits PHI and sensitive clinical notes until formal HIPAA readiness is approved.
Account control
Owners can export or delete account data through explicit, audited controls.
Know what belongs here.
Do not enter diagnoses, medical record numbers, insurance information, or other protected health information.
Report a security concern: support@vauxcorps.com