Settings & Security
This prototype is not end-to-end encrypted. It uses transport encryption, on-device encryption for offline records and aggregation rules, with an architecture prepared for further security review.
Synthetic demonstration data
Implemented safeguards
- HTTPS/TLS for all traffic on the hosted app
- Small-cell suppression: counts below 10 hidden in tables and exports
- Exports limited to aggregated data — no record-level exports
- Verbal autopsy records encrypted on device (AES-GCM, non-extractable browser key)
- Idempotency keys on offline records; local copies kept until server confirmation
- No secrets or database credentials in frontend code
- Synthetic data clearly labelled throughout
- Secure sign-in (email, Google, Lovable) with sessions and password reset
- Roles (field worker, reviewer, administrator) stored separately and enforced by the server
- Row-level security: field workers see only their own VA records; reviewers see all
- Sync to the server with idempotent uploads and a server-side reviewer workflow
- Offline app caching on the published app (not in the editor preview)
Remaining before real data
- Epidemiologist and surveillance-officer roles
- Row-level security and separation of identifiable VA records from analytical tables
- Server-side audit logs for sensitive access, edits and exports
- Encryption at rest for sensitive server records; retention & deletion policy
- Independent security review and threat model
Roles (least privilege)
| Field worker | Create & edit own assigned VA records |
| Reviewer | Return / approve VA records |
| Epidemiologist | Query aggregates, export suppressed data |
| Surveillance officer | Acknowledge, verify, escalate alerts |
| Administrator | Manage users, roles, data sources |
On-device storage limitation
Browsers cannot guarantee secure storage. The encryption key never leaves the browser and can't be exported, but anyone with access to an unlocked device and browser profile could still read records through the app. For field deployment, use managed devices with screen lock and full-disk encryption, or a native wrapper using the Android Keystore.