Security

A new professional account starts in demo mode. Real client records, assessments, plans and uploads stay locked until three things are true: the identity details are confirmed, a credential has been checked and approved by a reviewer, and the current sign-in passed two-step verification. This is enforced by the database itself, so it cannot be bypassed by the app, an API call, or a direct query.

Nobody can approve their own credential. Reviewers are a short, explicitly maintained list, must be on a two-step session, and cannot review their own submission.

A professional invites a client by email. The invitation is single-use, bound to that email address, expires, and can be revoked. Only a hashed form of the invitation link is stored. Before anything is shared, the client sees exactly what would be shared and by whom, and agrees to a specific, versioned consent text. A client who has not yet agreed cannot be shown their record, and a client can withdraw at any time.

Access is decided per row in the database, not by hiding buttons in the interface. A professional sees only their own clients; a client sees only their own record and only the plans their professional approved. Uploaded photos and documents live in private storage with the same rules applied to every file request.

Sign-in supports Google, Apple and email. Two-step sign-in uses an authenticator app and is required before real client data is unlocked. Inactive sessions time out, and signing out clears cached data so it cannot be recovered with the browser Back button. You can sign out of every device from Profile and settings.

Verification decisions, invitations, consent changes and refused attempts are all recorded with who, what and when. Audit records are append-only — they cannot be edited or deleted from the app — and they never contain health details, passwords or invitation links.

Card details are handled entirely by our payment provider and never reach TAALO servers. Payment notifications are signature-verified and processed once.

If you believe you have found a security issue, email security@taalo.app with enough detail to reproduce it. Please give us a reasonable window to respond before disclosing publicly. We will acknowledge within three working days.

See also our compliance position, which states plainly what we are and are not certified for.