Security & ProductionGuide
Encryption and secrets
How credentials and secrets are handled.
Handling
- Traffic is encrypted in transit; stored data is encrypted at rest by the managed platform.
- Integration and relay credentials are stored as protected secrets and are never returned to a browser.
- API key values are shown once at issuance and stored only in a non-recoverable form afterwards.
- Webhook signing secrets are protected server-side and are revealed only through authorized creation or rotation. They cannot be retrieved later.
- Rotating a webhook secret bumps its rotation generation and invalidates the previous secret immediately; the new value is shown once.
Important
Never send credentials, tokens or patient data through support forms or documentation feedback.