Security controls from day one
When your compliance team asks how the platform protects patient data, 'we think so' isn't an answer. CaseTrack Pro ships with per-user app-based MFA, a 30-minute idle logout, sign-in rate limiting, app-level encryption of sensitive fields, and an audit log of every case action — the controls your compliance team will ask about first.
App-based MFA
Each user can turn on time-based one-time passcodes with any standard authenticator app. Five wrong codes lock the sign-in attempt.
Inactivity timeout
A warning at 25 minutes and automatic logout at 30 minutes of inactivity, to protect patient data on shared devices.
Sign-in rate limiting
Login, password-reset, and signup attempts are rate-limited to slow brute-force attacks.
Encryption in transit and in the app
TLS with HSTS in transit. Patient initials and other sensitive fields are encrypted in the app with AES-256-GCM before they're stored.
Audit log of every case action
Every case action is captured with actor, time, record, and IP — searchable and exportable for compliance review.
Protected PDF access
Case summary PDF downloads use their own access check, separate from the page view. Trusted devices can reopen a used magic link without re-verifying.
Turn on MFA
Each user sets up an authenticator app from their profile in a couple of minutes.
Work with the defaults
Idle logout, sign-in rate limits, field encryption, and role-based access apply to every user without extra setup.
Audit on demand
Filter the audit log by actor, action, or date and export to CSV for your security review.
Frequently Asked Questions
- What security controls does CaseTrack Pro provide?
- CaseTrack Pro uses per-user app-based multi-factor authentication, server-enforced role-based access control, an audit log of every case action, app-level AES-256-GCM encryption of patient initials and other sensitive fields, private file storage with access-checked downloads, TLS, and idle timeouts.
- Does CaseTrack Pro support two-factor authentication?
- Each user can turn on app-based MFA with a standard authenticator app. Five wrong codes lock the sign-in attempt. MFA is enabled per user.
- How are attachments protected?
- Attachments are stored in a private bucket and downloads are streamed through the app after an access check.
- Is a BAA available?
- A Business Associate Agreement (BAA) is accepted at signup on every plan. Read it at https://casetrackpro.net/baa.