Security overview

Rotara holds student records, so security is built into how it stores and serves every row, not added on top. Here is how it works.

Separate spaces, enforced by the database

Every record belongs to one program. Row level security rules in the database check each request against the signed in person's program and role, so a page bug cannot show one program's data to another. These rules have their own test suite, including tests that try to read and change another program's records and must fail.

Accounts and access

• Accounts are invite only. No one can sign up from outside a program.
• Passwords must be at least 12 characters.
• Email sign in links work once, expire, and need a button press, so link scanners in email systems cannot use them up.
• Roles decide what each person can do. Program Directors manage staff and settings; Clinical Coordinators manage students, sites and schedules; Faculty can view.
• Switching off an account takes effect straight away.

Sensitive information

• No patient identifiers are collected.
• Private preceptor comments are stored apart from evaluations and are unreadable to students at the database level.
• Compliance documents are stored privately and opened only through short-lived links made after an access check.
• Clock in reads a phone's location once, only when the student taps the button.

Infrastructure

• All traffic uses HTTPS, with strict transport security.
• Data is encrypted at rest by the database provider and hosted in the United States.
• Pages send security headers that block framing and content sniffing, and allow location only for Rotara itself.
• Clock in, clock out and evaluations are recorded by database functions that check every input, never by the browser directly.
• Changes by program staff are recorded in an activity log the Program Director can read.

For university review

Programs whose institutions need a security questionnaire or an accessibility conformance report can ask through the contact form, and we will provide completed answers.

Reporting a problem

If you think you have found a security problem, please tell us through the contact form before sharing it anywhere else. We will look into it straight away.