Plaid OrcaTrust
Security and privacy overview
Last updated
A one-page summary for IT, compliance and procurement teams at health centers and health plans.
Plaid Orca works like a website tool, not a clinical system. The patient finder never asks for or stores names, birth dates, Medi-Cal or member numbers, immigration status, diagnoses or contact details. The only personal information we hold is staff work emails and the organization settings you choose to enter.
No patient data, by design
- Patients never create an account and are never asked who they are.
- A search is stored as the type of care, the ZIP code, the number of results, the organization's finder and the time. No IP address, device ID or cookie is stored with it, so a search can't be traced to a person.
- Organizations see totals only, such as searches by care type and ZIP code.
- Staff are told on every notes field, and agree in our terms, not to enter patient information.
Architecture and hosting
- The website, finder and dashboard run on Vercel's platform. Data is stored in a managed PostgreSQL database run by Supabase, in the United States.
- The finder appears on your website inside an isolated frame served from our domain. It can't read the page around it, and your page can't read it.
- The embed only loads on the website domains your organization approves. Other sites are refused by the browser.
- Fonts and page resources are served from our own domain. There are no analytics, advertising or social media scripts.
Security controls
Encryption
HTTPS only, with HSTS preloading, on every page and API call. Data is encrypted at rest by our database provider.
Access control
Row-level security in the database separates every organization. Staff see only their own organization's notes and settings, and roles separate admins from staff.
Sign-in
Staff sign in with a one-time emailed link or a password. Passwords are stored only as one-way hashes by our authentication provider.
Browser protections
A strict Content Security Policy, frame-ancestor rules, a same-origin opener policy, a restrictive permissions policy and no-sniff and referrer headers on every response.
Least privilege
Server-only keys never reach the browser. Database tables are closed to direct access, and changes go through checked server functions.
Records
Acceptance of our terms is recorded with the version, time, IP address and browser. Our providers keep security and access logs.
Subprocessors
These companies process data on our behalf. We'll update this list before adding a new one that handles organization data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting and content delivery | Web requests and technical logs | United States |
| Supabase | Database and staff sign-in | Staff accounts, organization settings, notes, Verifications, search totals | United States |
| Email delivery provider | Sign-in and invitation emails | Staff email addresses | United States |
| U.S. Census Bureau Geocoder | Map coordinates for clinic sites | Clinic site addresses only | United States |
Incident response
If we confirm a security incident that exposes an organization's data or its users' account information, we notify the organization's admin without undue delay and within 72 hours of confirming it. We tell you what happened, what data was involved, what we've done and what you should do, and we follow up as we learn more. We also notify individuals and regulators where the law requires it.
Report a vulnerability
If you think you've found a security issue, email support@plaidorca.com with the details and steps to reproduce it. We acknowledge reports within 3 business days and keep you updated until it's fixed. Our contact details are also published at /.well-known/security.txt.
When testing, please:
- use only accounts you own, and don't access, change or delete other people's data;
- avoid denial-of-service, spam, social engineering and physical attacks;
- give us reasonable time to fix the issue before you share it.
We won't pursue legal action against good-faith research that follows these rules and our terms of use.
Compliance
- HIPAA: Plaid Orca doesn't create, receive, keep or send protected health information, so it is not a business associate and doesn't sign business associate agreements.
- California privacy laws: we follow the CCPA, honor Global Privacy Control, and don't sell or share personal information. See our privacy policy.
- Accessibility: WCAG 2.2 Level AA. See our accessibility statement.
- Security reviews: we complete security questionnaires for health centers and health plans on request.
Contact
- Operator
- Plaid Orca
- Security and privacy
- support@plaidorca.com
- Security reports
- Acknowledged within 3 business days