Encryption and secrets

• Traffic is encrypted in transit; stored data is encrypted at rest by the managed platform.
• Integration and relay credentials are stored as protected secrets and are never returned to a browser.
• API key values are shown once at issuance and stored only in a non-recoverable form afterwards.
• Webhook signing secrets are derived from a server-only root secret and a rotation generation; only the algorithm and generation are recorded, so no recoverable signing secret is stored.
• Rotating a webhook secret bumps its generation and invalidates the previous secret immediately; the new value is shown once.

Never send credentials, tokens or patient data through support forms or documentation feedback.