Security & Disclosure

• Each workspace is isolated from every other at database level, and automated tests check that isolation on every change.
• All traffic is encrypted, and stored data is encrypted at rest. Team messages are end-to-end encrypted, and medical profiles use a key specific to the workspace.
• Photos, documents and other files are kept in private storage and opened through short-lived signed links.
• Multi-factor authentication, with verification again for sensitive actions such as billing changes. People who are suspended or removed are signed out on every device.
• Role-based permissions, and a tamper-evident audit log of important actions.

The full list of measures is in the annex to our Data Processing Addendum.

If you think you have found a security issue, please email help@reccenet.com, with “Security” in the subject line and enough detail for us to reproduce it, and how you would like to be credited. We will acknowledge your report within 3 working days, keep you informed, and tell you when it is fixed.

In scope: https://reccenet.com, https://admin.reccenet.com, https://app.reccenet.com, and the Recce Net iOS and Android apps. Please:

• test only against workspaces and accounts you own or have created for testing;
• never access, change or delete other people’s data. If you come across any by accident, stop, and tell us what you saw;
• not run denial-of-service tests, spam, social engineering or physical tests, or automated scanning that degrades the service;
• give us reasonable time to fix an issue before disclosing it publicly.

If you act in good faith and follow these rules, we will not take legal action against you for your research, and we will work with you to understand and resolve the issue.

If a security incident affects your personal data, we will tell affected customers without undue delay, as our Data Processing Addendum and Privacy Policy describe.