Encryption
In transit
All data transmitted between clients and MASLOW servers is encrypted using TLS 1.2 or higher. This includes:- Patient survey submissions
- Provider dashboard access
- API communications
- Email notifications (via TLS-enabled email providers)
At rest
All stored data is encrypted using AES-256 encryption. This covers:- Database records (survey responses, patient profiles, reports)
- File storage (exported reports, attachments)
- Backups and archives
Data storage
- Location — data stored in AWS US regions
- Database — managed database services with automated backups
- Isolation — tenant data is logically isolated
Data retention
MASLOW retains clinical data in accordance with applicable healthcare record retention requirements. Default retention periods:| Data type | Retention period |
|---|---|
| Survey responses | Per clinic policy (minimum as required by state law) |
| AI reports | Same as survey responses |
| User accounts | Until deactivated + retention period |
| Audit logs | Minimum 6 years |
Audit logging
All access to patient data is logged, including:- Who accessed the data
- When the access occurred
- What action was performed (view, export, etc.)