Security
Last updated 24 July 2026
A summary of how Ayunila protects clinic and patient data. Every control listed here is implemented in the product today; we've deliberately left out anything we can't stand behind.
Encryption
- Sensitive clinical fields are encrypted in our database.
- All traffic to and from Ayunila is encrypted in transit (HTTPS/TLS).
Tenant isolation
Ayunila is multi-tenant software: every clinic's data is logically separated from every other clinic, and every request is checked against the clinic (and branch) the signed-in user belongs to before it can read or write that clinic's data.
Access control
- Role-based access control — staff see only the parts of the product their role needs (for example, a pharmacist's access differs from a doctor's or a receptionist's).
- Two-factor authentication (TOTP) is available for staff accounts.
- Login, OTP and password-reset endpoints are rate-limited to slow automated abuse.
Audit logging
Access to patient records and key administrative actions are recorded in an audit trail, which clinic owners and platform administrators can review.
What we don't claim
We have not obtained third-party certifications (such as SOC 2 or ISO 27001) at this time, and we do not represent Ayunila as being certified under any specific healthcare-compliance framework. If your organisation requires a security questionnaire or documentation beyond what's on this page, contact us and we'll do our best to help.
Responsible disclosure
If you believe you've found a security vulnerability in Ayunila, please tell us before disclosing it publicly, and give us reasonable time to investigate and respond.
[TODO: owner to set up a dedicated security-disclosure contact address (e.g. [email protected]) and publish it here — in the meantime, reports can be sent to the address below.]