Security you can verify — not a badge to take on faith.
Most security pages are a wall of logos. This one is a list of claims you can check yourself, right now, from your browser — followed by an honest list of what we don’t claim yet. We think that’s worth more.
Check us from your chair
Open your browser’s developer tools on this page, or paste moodtracehealth.com into a header scanner like securityheaders.com. You should find:
Strict-Transport-Security
Two-year HSTS with preload — browsers refuse to ever connect to us over plain HTTP.
Content-Security-Policy — enforcing, with violation reporting
Scripts run only from our own origin and our analytics provider. Anything else is blocked by your browser, and the violation is reported so we see it.
X-Content-Type-Options · X-Frame-Options · Referrer-Policy
MIME sniffing off, clickjacking framing denied, referrers trimmed to origin.
Permissions-Policy
Camera, microphone, and geolocation are denied on this site — declared in the header.
No source maps, no secrets in the bundle
View source: minified application code, no API secrets, no keys. Secret scanning runs on every commit.
The architecture: the client holds nothing worth stealing
Anti-debugger tricks are theater, and we don’t do theater. Anyone can open developer tools on any website — so our defense is architectural, not cosmetic:
- Authorization lives server-side. Every data access is checked against server-enforced security rules and typed, validated server functions — what the browser asks for is never what decides.
- Clinical access is role-gated: care-team membership and roles are verified on the server for every call, with minimum-necessary data returned to the screen.
- There is no SQL anywhere in the stack — SQL injection is structurally impossible, not merely defended.
- All rendered text is auto-escaped by the framework; our codebase contains zero uses of the unsafe HTML escape hatch (audited).
- Public forms carry honeypots, timing traps, and rate limits; invite links are single-use and cryptographically signed.
- Errors return generic messages to the browser; diagnostic detail goes to server logs. Provoking an error does not open a door.
Data protection
- Encrypted in transit (TLS) and at rest (AES-256 on Google Cloud infrastructure).
- Patient-controlled sharing: nothing is shared with a care team until the patient authorizes it, and authorization is revocable.
- Minimum-necessary discipline for protected health information in interfaces and logs — enforced by a CI rule that blocks patient identifiers from console output.
- No advertising cookies, no tracking pixels, no cross-context behavioral advertising, no data resale — ever. This is a founding commitment (see the Privacy Policy), not a settings default.
How we build
Static analysis (SAST)
Semgrep on every commit, including custom healthcare rules we wrote ourselves: no patient identifiers in logs, no unsafe CSV cells, no internal tracking language in shipped copy.
Secret scanning
Gitleaks on every commit — credentials cannot land in the repository.
Dependency & container scanning
Trivy plus gated dependency updates — a broken or vulnerable bump fails the build.
Dynamic scanning (DAST)
Scheduled OWASP ZAP baseline probes the deployed site — headers and error behavior are re-verified on a schedule, not assumed.
Configuration drift guards
Fee schedules, clinical thresholds, and rendered copy are each guarded by an independent CI check that fails loudly on divergence.
Review gate
Every change ships through a pull request and a human review. No direct pushes to production branches.
HIPAA, plainly
MoodTrace is HIPAA-readied, and we execute Business Associate Agreements for clinical deployments. Patient-side rights and the HIPAA / non-HIPAA boundary are spelled out in our Privacy Policy; the formal Notice of Privacy Practices is in final legal review and available on request.
One thing you should know as a buyer: there is no such thing as “HIPAA certified.” No government body certifies HIPAA compliance. Anyone selling you a HIPAA certification badge is selling you a badge.
The honest gaps
- SOC 2 Type II: not yet certified. Our cloud providers (Google Cloud, Vercel) hold their own certifications — but those certify their infrastructure, not our processes, and we won’t borrow their scope the way many vendors do. Our own certification is on the roadmap as the company scales. Everything above is checkable today, which no annual report can say.
- Some hardening is staged, not finished. Security is a process with a punch list, and ours is versioned and reviewed like everything else we ship. When a capability is not live yet, we say “coming soon” — on this page and everywhere else.
Found something?
If you believe you’ve found a security issue, email support@moodtracehealth.com with “Security” in the subject. Reports go straight to the founder. We respond, we fix, and we credit researchers who want credit.
In crisis right now? MoodTrace is not an emergency service. If you are thinking about suicide or experiencing a mental-health emergency, call or text 988 (Suicide & Crisis Lifeline — 24/7, free, confidential, U.S.), text HOME to 741741 (Crisis Text Line), or go to your nearest emergency room.
This page is maintained against our deployed configuration, not our intentions. Last verified against production: July 30, 2026.