Version 1.0 · Last updated: November 11, 2026
This is the same text the BackPR app shows at app.backpr.com/legal/security. Leer en español
A short list of what BackPR really does to protect data. We do not claim any third-party security certification.
Separation
- Each organization has its own private database. A request for one organization cannot read another organization's database.
- Private files (uploads, exports, signed documents) are stored under the organization's own area and sealed with a key that belongs to that organization. Images an organization publishes on its public pages (logo, website pictures) are public by design.
Encryption
- All connections use HTTPS.
- Health records and custody notes are encrypted field by field with a key of the organization, on top of the storage provider's own encryption at rest.
- Weekly backups are compressed and encrypted before they are stored. Eight weekly backups are kept.
Access
- Sign-in with a passkey (recommended) or a one-time email code. No passwords.
- Roles and permissions decide what each person can see and do. Sensitive actions (exports, staff roles, approvals) need a fresh confirmation.
- BackPR's own platform administration requires a passkey.
Traceability
- Each organization has an audit log of changes. Entries are chained with hashes so a later change to the log can be detected.
- Electronic signatures on our documents are stored as append-only records.
Abuse protection
- Automatic bot checks and rate limits on sign-in, sign-up and checkout.
- New organizations start with conservative limits that widen as the organization is verified.
Payments
- Card details are entered into Stripe's own forms. BackPR never stores card numbers.
What we cannot promise
No system is free of risk. If we learn of a breach that affects your data we tell the affected organization without undue delay.
Report a security problem: hi@backpr.com