Security measures

1 · What this document covers

This document summarises the security measures Tsunami Automation Global LLC uses today in Soluciones para Doctores. It says what exists. It is not a certificate and it does not promise that an incident will never happen.

The clinic is the controller (responsable) of its patients' data. Tsunami Automation Global LLC is the processor (encargada): it handles the data on the clinic's instructions. Tsunami Automation Global LLC is a controller only for its own data (clinic users, visitors, prospects, directory listing and billing contacts). The measures below protect both kinds of data.

The law asks for administrative, technical and physical security measures, at least as strong as the ones we use for our own information. This text explains how we do it and where we are not there yet.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 2, fracs. XII y XIV; LFPDPPP (DOF 20-mar-2025), art. 18

2 · Where the data is

The application and the database are hosted with a cloud infrastructure provider in the European Union, in Germany (Nuremberg). That is outside Mexico. The backups are in separate storage with the same hosting provider. The full list of providers that receive data is in the sub-processors document.

We do not store card numbers. When a clinic turns on online payments, the card number goes to the payment processor (Stripe or Mercado Pago), not to us.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

3 · Encryption

• Field-level encryption with AES-256-GCM for the patient's name, email, phone and notes, for message text, for appointment notes and for the transcripts of voice calls that we store. If someone gets a copy of the database, those fields look like encrypted text.
• To search for a patient by email or phone we use a keyed index (HMAC). The value does not need to be stored in clear text to be searched.
• The secret of two-step verification is also stored encrypted.
• The connection between your browser and the platform uses HTTPS, with one-year HSTS so the browser does not fall back to an unencrypted connection.

Field-level encryption covers the data in the list above. Not every field in the database is protected this way. The others are protected by the access control and the per-clinic isolation described below.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; Reglamento de la LFPDPPP (2011), arts. 57-62

4 · Accounts, passwords and sessions

• Passwords are stored as a scrypt hash with its own salt. We never store the password in clear text. We ask for at least 10 characters with a letter and a number.
• Sessions use a random code. In the database we store only its hash. The cookie is HttpOnly, Secure and SameSite. A clinic session closes after 7 days without activity and, at most, after 30 days.
• Email sign-in links last 20 minutes and password-reset links 30 minutes. Team invitations last 7 days.
• After 5 failed sign-in attempts, the account is locked for 15 minutes. Failed two-step verification attempts count toward the same lock.
• Public endpoints (sign-in, sign-up, password reset, contact forms, ARCO rights and intake forms) have rate limits per IP address.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; Reglamento de la LFPDPPP (2011), arts. 57-62

5 · Two-step verification

Every user can turn on two-step verification with an authenticator app (TOTP codes) and receives recovery codes.

It is not mandatory yet. We can require it for the owner and administrator roles, but that enforcement mode is being rolled out in stages and is not active for everyone today. We recommend that you turn it on for your account now.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

6 · Isolation between clinics and roles

Each clinic is a separate space. The database applies row-level security: on the great majority of tables, a query only sees the rows of the clinic that signed in. The application connects with a limited-privilege database user, not with an administrator.

Inside a clinic, permissions depend on the role (owner, administrator, professional, reception, billing and others). Each team member sees only what their role allows.

The law requires confidentiality from everyone who takes part in processing data. Our team handles clinic data only to run and support the service.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; LFPDPPP (DOF 20-mar-2025), art. 20

7 · Action log (audit trail)

We keep a log of sensitive actions: who did them, in which clinic, what kind of action, when, and the IP address and browser. The log does not copy clinical content; it keeps minimal data. It is used to investigate an incident or a question.

The log covers sensitive actions, not every read of every screen.

Legal basis: Reglamento de la LFPDPPP (2011), arts. 57-62

8 · Application protection

• Security headers on all responses: HSTS, a Content Security Policy (CSP) with a per-request nonce, clickjacking protection (X-Frame-Options DENY and frame-ancestors none), X-Content-Type-Options nosniff and a restrictive referrer policy.
• Origin check on actions that change data from the browser, against forged requests (CSRF).
• Signature checks on the webhooks from WhatsApp (Meta), the telephony provider and the payment processors. A call without a valid signature is rejected.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

9 · Error logging

Technical errors are logged in a service we run on our own servers in Germany. They are not sent to a third party. The configuration turns off sending personal data by default, and our logs hide sensitive fields by name (password, token, phone, email, name, notes and similar).

Hiding by field name lowers the risk, but it does not guarantee that a free-text error message never contains a personal data item.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

10 · Backups and recovery

• One daily copy of the database. We keep 31 copies.
• A copy in separate storage, apart from the application server, every 6 hours. We keep 14 generations.
• We have performed and documented one restore test. It is not yet an automatic or periodic test.
• Sensitive fields are already encrypted inside the copy (see Encryption). We do not claim extra encryption of the disk or of the backup files.

If a data item is deleted after a cancellation request, it can remain in the backups until they are renewed (up to 31 days in the daily copy).

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

11 · Providers, artificial intelligence and voice

To deliver the service we use international providers (language models, voice, WhatsApp, calls, email). Each one receives only the data it needs for its function. The sub-processors document says which ones they are, what they receive and in which country.

• The AI receptionist sends the patient's message and up to 12 earlier turns of the conversation to the language model. The safety rules for the reply (for example, emergencies) are applied after the model has received the text. If a patient writes symptoms, that text reaches the model provider.
• Calls with the voice agent are recorded and kept by the voice provider until they are deleted. We keep our own encrypted copy of the transcript.

If you need us to delete a call or a message, write to privacy@tsunamiautomation.com.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; LFPDPPP (DOF 20-mar-2025), art. 13

12 · What we do not do yet / limits

We prefer to say this clearly:

• We do not have a third-party security certification (such as SOC 2 or ISO 27001).
• We have not published an independent penetration test.
• Encryption keys are not rotated automatically.
• We do not claim encryption of the server disk or of the backup files. Sensitive fields are encrypted at field level.
• Two-step verification is available, but it is not mandatory for anyone yet.
• Voice recordings stay with the voice provider until they are deleted.
• We do not automatically delete old messages or other old data. Deletion and ARCO cancellation are a manual procedure that we complete within the legal deadline.
• We are not a HIPAA covered entity and we do not claim HIPAA compliance. See the health-sector summary.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18

13 · What your clinic is responsible for

Security is shared. The platform cannot protect what leaves it by other means. We ask each clinic to:

• Use strong, unique passwords, not share accounts, and turn on two-step verification.
• Remove people who leave the team right away and review the permissions of each role.
• Keep the devices that access the platform secure (screen lock, updates, no doubtful software) and not sign in on public computers.
• Not copy patient data to places outside the platform (personal chats, unprotected email, shared spreadsheets).
• Tell us without delay if you suspect unauthorised access, a compromised account or a lost device, at support@tsunamiautomation.com.

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 18; LFPDPPP (DOF 20-mar-2025), art. 20

14 · How to report a vulnerability

If you found a security flaw, write to support@tsunamiautomation.com with the subject "Seguridad". Describe what you saw, how to repeat it and which page or function it affects.

• Do not access other people's data beyond the minimum needed to show the flaw.
• Do not disrupt the service or run load tests.
• Do not publish the flaw until we have had a chance to fix it.

15 · If a security breach happens

1. We assess what happened, which data and which clinics are affected.
2. We contain the problem: we close access, change credentials and preserve the evidence.
3. We notify the affected clinics without undue delay and within 72 hours after we confirm the breach. We give them the information they need to act.
4. The clinic, as controller, notifies the patients immediately when the breach significantly affects their property or moral rights.
5. We record the incident, fix the cause and review what we learned.

The law does not set a number of hours. The 72-hour period is our commitment to clinics. The details of how the clinic and we work together are in the data processing agreement (/legal/en/contrato-encargo).

Legal basis: LFPDPPP (DOF 20-mar-2025), art. 19; Reglamento de la LFPDPPP (2011), arts. 63-66