Security and privacy in Brauni: how we protect your patients' data

If you are a psychologist, you know that confidentiality is not optional. It is the basis of the therapeutic relationship. Every session note, every medical records, every personal data of your patients deserves the maximum possible protection.

In Brauni we take this very seriously. It is not a slogan: it is engineering. In this article we show you, with total transparency, the safety layers that protect clinical information within the platform.

Data encryption: your information is unreadable without the key

All sensitive data from your patients is encrypted before being stored in the database. We use AES-128 in CBC mode with HMAC authentication (Fernet encryption) for clinical fields, and the platform also has rest encryption administered by the cloud provider and TLS 1.3 in transit.

What does this mean in practice? If someone accessed the database directly, they would see incomprehensible text strings. Without the encryption key, the data is useless.

What data are encrypted?

• Patient names and surnames
• Dates of birth
• Document numbers
• Session notes and medical records
• Telephones and invoicing data
• Uploaded files (encrypted before being sent to storage)

In addition, each file uploaded to the platform is checked with a SHA-256 hash, a unique fingerprint that detects any alteration. If a file was modified - by mistake or by an attack - the system detects it automatically.

Authentication: more than a password

Passwords protected with Argon2id

We do not save your password. We save a mathematical derivative generated with Argon2id, the winning algorithm of the Password Having Competition and considered the safest in the world today.

Why does it matter? Other systems use older algorithms like bcrypt or SHA-256. Argon2id is designed specifically to be resistant to attacks with specialized hardware (GPUs and ASICs), because it requires a lot of RAM for every attempt at divination.

Multifactor authentication (MFA)

Brauni offers four methods of authentication in two steps to choose the one that suits you best:

• Authentication App (TOTP): Google Authenticator, Authy or another app generates 6 digits that change every 30 seconds.
• Email code: You receive a temporary code of 6 digits in your mail.
• Security key (WebAuthn/FIDO2): you can use a YubiKey or other physical key. It is the safest method that exists.
• Backup codes: 10 single-use codes for emergencies if you lose access to your second factor.

Protection against brute force attacks

If someone tries to guess your password, Brauni responds in multiple layers:

1. Account Lock: after 5 failed attempts, the account is locked for 15 minutes.
2. Immediate Notification: You receive an email informing you that someone tried to access your account.
3. Speed limits: the system limits the number of login attempts, registration and IP password recovery.

In addition, the system is designed to not disclose if an email is registered. If someone tries to sign in with an email that does not exist, the answer is identical to that of an incorrect password. This prevents the enumeration of users.

Tokens and sessions: controlled access at all times

Short duration tokens

When you sign in, Brauni generates a access token that expires in 15 minutes. This minimizes the exposure window if someone intercepts the token.

So you don't have to sign in every 15 minutes, we use one-use soft drink tokens. Every time your session is renewed, the previous token is invalidated. If someone tries to reuse an already used soft drink token, the system detects the attack, overrides the entire session, and records the incident.

Instant revocation

You can close all your active sessions with a single click. The system uses versioned tokens: when you revoke, change the version and all tokens previously issued cease to be valid instantly.

File protection: deep defense

Uploading files to a clinical platform is a common attack vector. Brauni implements 6 validation layers before accepting any file:

Prevention of unauthorized access (IDOR)

One of the most common attacks on web applications is the IDOR (Insecure Direct Object Reference): one user tries to access data from another user by changing an ID in the URL.

In Brauni, each operation on patient data validates that the professional making the request is the owner of that data. If a psychologist tries to access a patient that does not belong to him, the system responds with a generic error that does not even confirm if that patient exists. Zero leaks of information.

Activity log: full audit

Brauni automatically records any relevant action in an unchangeable audit log:

• Who agreed, when and from where (IP, browser)
• Which patient was consulted or modified
• What type of operation was performed (reading, creation, modification, elimination)
• Security events (failed login attempts, password changes, MFA activation)

This record cannot be deleted or modified. It meets the traceability requirements that require health data protection regulations.

Security headers: network-level protection

Each server response includes security headers that protect against common attacks:

• HSTS: forces the use of HTTPS at all times (2 years of validity, includes subdomains)
• CSP: blocks the execution of unauthorized scripts
• X-Frame-Options: prevents clickjacking attacks (nobody can embed Brauni in an iframe)
• X-Content-Type-Options: prevents the browser from misinterpreting files
• Permissions-Policy: disables access to camera, microphone and geolocation from the browser

CSRF protection: safe forms

Brauni implements the double cookie CSRF (Double-Submit Cookie) pattern. Each sensitive operation requires a cryptographically signed token that is validated against a cookie. This prevents a malicious site from running actions on your behalf if you visit a dangerous link.

CSRF tokens expire at 1 time and use HMAC-SHA256 for signature, making it impossible to falsify them.

Identity verification (KYC)

To ensure that only real professionals use the platform, Brauni offers identity verification through Stripe Identity. The process includes:

• Photo ID (DNI, passport or license)
• Real-time selfie to verify that the person matches the document
• Safe processing by Stripe -Brauni never stores the document photos

Google OAuth with PKCE: secure login with Google

If you prefer to sign in with Google, Brauni uses the Authorization Code with PKCE (Proof Key for Code Exchange), the safest standard for OAuth. This prevents interception attacks from the authorization code, even on compromised connections.

Secret management: nothing in the code

Encryption keys, external service credentials and sensitive configurations never in the source code. In production, a service specifically designed to store secrets safely and audited is obtained from AWS Systems Manager Parameter Store,.

When starting, the system validates that the keys meet minimum safety requirements. If it detects a weak or development key in a production environment, refuses to boot.

Why so many layers?

In computer security there is a principle called in-depth defense: you never depend on a single protective measure. If one layer fails, the following ones continue to protect the data.

Brauni implements this principle at each level:

• Data at rest: Fernet encryption (AES-128) field by field + rest encryption administered by cloud provider
• Data in transit: HTTPS mandatory with HSTS
• Authentication: Argon2id + MFA + Account Lock
• Authorization: validation of ownership in each transaction
• Archives: 6 validation layers before accepting a upload
• Sessions: Short duration tokens + single-use soda
• Auditry: Unchangeable record of any activity
• Red: security headers in each response

Your responsibility as a professional

The platform does its part, but security is shared. We recommend:

• Activate authentication in two steps (MFA) from your account settings
• Use a unique password for Brauni that you do not use for other services
• Don't share your session -each professional must have his own account
• Session closed when using a shared computer

Transparency commitment

Safety should not be a black box. We believe that health professionals deserve to understand how their patients’ data is protected. That’s why we publish this article and will continue to share updates on the safety measures we implement.

If you have questions about security or privacy, please write to soporte@brauni.io. We are here to help you.

---

Brauni complies with the principles of Argentina's Personal Data Protection Act 25.326 and is aligned with the international standards of HIPAA for the management of protected health information (PHI).