← Minnato

Security

Last updated 26 August 2026

This describes how the system is built. Where something is not done, it says so.

Where patient data lives

• Every practice has its own encryption key, wrapped by a key management service that refuses to unwrap it under any other practice's identity. One practice's data cannot be decrypted with another's key even by mistake.
• Answers are encrypted before they are written, and the practice identifier is bound into the ciphertext, so a record moved between rows fails to decrypt rather than decrypting as somebody else's.
• Deleting a practice's key makes their data unreadable everywhere it exists, including in backups, without touching anyone else's.

Who can read it

• Access is decided by the database itself through row-level security, not by application code remembering to check. A query written incorrectly returns nothing rather than returning too much.
• An agency managing a practice's forms can be given access to everything except submissions. For them those records do not exist — not hidden, not redacted, absent. This is what lets an agency run many sites without becoming a business associate.
• Operating this platform does not grant access to patient data. Our staff can see that a practice received 412 forms; reading one requires a grant on that practice, and every such read is recorded.

What leaves, and what does not

• Patient information may only be forwarded to a vendor who has signed a business associate agreement. This is enforced against a registry we maintain — a practice cannot declare that an uncovered vendor is acceptable.
• Uncovered destinations can still receive a notification, with every field the form marks as patient information removed first.
• Form pages load no third-party code. No analytics, no tag manager, no fonts from a content delivery network, no CAPTCHA. A font host would receive the visitor's IP address from a page collecting health information.

Collection is gated on paperwork

A practice cannot collect patient information until the agreements its arrangement requires are countersigned. This is checked when a submission is written, not when a form is designed, so an unsigned practice fails closed.

Attachments

A file is typed from its own contents rather than what the browser claims, scanned, and served only once a scan has found it clean. A file that has not been scanned is withheld rather than passed along and checked later.

What this does not do

• Tracker scanning reads the HTML a page delivers. It catches trackers in the markup — the great majority — but not one injected afterwards by another script. A clean report is evidence, not a guarantee.
• We are not a covered entity and do not give legal advice. Which agreements a practice needs is a question for their counsel.

Reporting a problem

Email security@minnato.ai. We will confirm receipt within one business day. We will not pursue anyone who reports a genuine finding in good faith and gives us a reasonable chance to fix it.