Security

1. How we protect data

• Encryption in transit: all communication uses HTTPS (TLS) with HSTS.
• Encryption at rest: the database and files are stored encrypted.
• EU-only hosting: servers are located in Frankfurt, Germany.
• One-time codes: opening a result always requires a 6-digit code, valid for 10 minutes, with 5 attempts.
• Rate limits on code requests and sign-in attempts, against guessing attacks.
• Mandatory two-step verification for laboratory staff: a code by email or SMS on every new device.
• Isolation between laboratories: each laboratory sees only its own patients and results, enforced by row-level isolation in the database.
• Immutable PDFs: each result is stored with its SHA-256 fingerprint, so any alteration would be detected.
• Complete access logs: every opening of a result and every change of phone number or email is logged.
• No result opens with the email link alone: the code is always required.
• Security headers: the website cannot be embedded in other websites and does not pass its address on to other sites (no referrer).
• Staff can open PDFs only through our servers: every opening is logged, and above 200 in one hour access is cut off.
• Sensitive tests (HIV, hepatitis, genetics): the laboratory can choose to hand them over in person. The patient is then not notified and sees nothing online until the laboratory allows it.
• Inspection register: each laboratory can give the health inspectorate the list of what it sent, with no medical content.

2. Verifiable by anyone

These independent checks are public: anyone can run them again on rezulto.app.

• Qualys SSL Labs — HTTPS configuration: A+
• Mozilla HTTP Observatory — security headers: A+
• Service status — checked every hour, last 90 days

3. Tips for patients

• Never share your code with anyone.
• Rezulto will never ask you for your code by phone.
• Check that the address in your browser is rezulto.app.
• On shared devices, sign out when you have finished.

4. Reporting vulnerabilities

If you find a security vulnerability, write to us at security@rezulto.app with a description and the steps to reproduce it.

We will not take legal action against researchers who act in good faith and follow these rules:

• do not access data beyond what is needed to prove the vulnerability;
• do not carry out attacks that disrupt the service (DoS);
• give us time to fix the issue before making it public.

5. Incidents

In the event of a security incident affecting personal data, the laboratories concerned are notified within 48 hours, so that they can take the necessary measures and inform patients and authorities as required by law.