Security
What happens to what your physicians say
A medical staff answers this once a year, in confidence, about the people who run their hospital. Everything below is a property of the running product, and beside each one is what an automated check would have to catch for it to stop being true.
Nothing is reported for a small group
Every figure passes through one function that applies the reporting floor, and every table that could give a withheld cell away by subtraction withholds its complement as well. A withheld cell prints the reason it was withheld rather than a blank or a zero, on screen and in every exported file.
The floor is set per organization, printed on every report, and cannot be changed quietly between years to make a figure appear.
A build check fails if any surface or exported file renders a figure below the floor, or leaves a withheld cell blank instead of stating its reason.
A response is confidential, and the product can prove it
Answers are stored against a response, never against a name. An invitation link is stored as a hash, so a copy of the database does not open anybody’s survey. Free text is redacted before any console screen renders it: emails, phone numbers and links come out, and names carrying a title come out.
The console never reads the original text: the query behind every comment surface omits that column, so a screen cannot render text it never loaded. Nothing re-attaches a response to the person who gave it either. There is no administrator role, no export and no support request that returns an individual answer or the person who gave it, because no code path in this product produces one.
A build check masks a name, an email, a phone number and a link before any of them reaches a surface, and fails if a single invitation row anywhere holds a link in the clear.
Who can see what is enforced, not displayed
A hospital chief executive inside a system sees their hospital and nothing else: every page, every cut, every downloaded file is confined to their subtree. Scope is read from the session, never from the address bar, and the confinement is applied in the query rather than in the rendering.
Access is granted per person, per facility, by an administrator, and every grant and revocation is in the log.
A build check signs in as a scoped operator and fails if any page, cut or download returns a row from outside their subtree.
Every read and write is recorded
The audit log is append only and carries the operator’s name. It records sign-ins, roster imports, fielding a survey, every change to who can open the console, and every file downloaded with its row count. There is no entry for overriding the reporting floor, because there is no way to override it.
Nothing sends without somebody deciding to send it
Invitations and reminders are composed and held. The administrator delivers them. A report on a standing order is the one message the clock delivers on its own, and only to console operators of that organization, who can already read it.
There is exactly one mail transport in the codebase, it refuses to run unless it is configured, and it is called from three places only: the sign-in link, the delivery desk and the scheduled report.
A build check fails if a second way to send appears anywhere in the codebase.
The data is yours on the day it is collected
Every raw response row, every item summary, every segment table and the codebook download from the console. Raw rows carry no name, email, member id or invitation id, and free text leaves redacted. Suppression travels with the file rather than being dropped at the door.
How the mail actually reaches a physician
Today it does not: the product composes every invitation and reminder and holds it, and the survey administrator delivers each one by hand from their own mail client. That is slower, and it has one property worth having during a pilot, which is that the message is signed by the clinical leader whose name is on the survey and carries their address as the reply-to, so a physician who answers it reaches a person at your hospital rather than a vendor.
When sending is turned on it goes through one transport, over HTTPS, from a domain whose SPF, DKIM and return path records are published before the first message. Nothing is sent from a shared or unauthenticated domain, because a physician survey that lands in quarantine is a response rate problem before it is anything else.
A hospital that would rather send no mail at all can field the whole survey on printed letters carrying spoken codes, answered over a phone line. There is also a poster address where a physician types their own identifier, though that one still needs an address or a mobile number on the roster to send the link to. Both are in the product, not a plan.
A build check fails if a second way to send appears, and if the product offers a channel it cannot actually field a survey on.
What this does not have
No national physician norm set. Comparison against other organizations appears once five have contributed, and until then the comparison is your own prior year, imported from whatever vendor you were with. A percentile computed across two hospitals names the other hospital.
No third-party penetration test and no SOC 2 report. If either is a requirement, it gets scheduled rather than claimed.
Where it sits
The application runs on Vercel. The database is Postgres on Neon, in the United States, encrypted at rest and in transit. Access to the production database is limited to the Fair Market Fast staff who operate the service. No hospital account has it, and no console role grants it.
Questions
Security questionnaires, a data processing agreement, or anything your counsel needs: write to bmolina@getcovershift.com.