Security

How we keep your data safe: encryption, access control, audit logs and a careful choice of providers.

Last updated 31 October 2026

Scope

This page describes how BÚZIOS E TARTARUGAS - LDA protects personal data on Eleva.care. Eleva operates the technology platform; independent experts deliver healthcare.

Organisational measures

Privacy and security responsibilities assigned within the company, with a data protection contact at privacy@eleva.care; an external data protection officer is being appointed.
Vendor review before onboarding subprocessors (see Sub-processors).
Development practices that include code review, dependency monitoring, and least-privilege access to production systems.

Technical measures

Encryption in transit: TLS for all browser and API traffic; strict transport security on public sites.
Encryption at rest: Database and private file storage use industry-standard encryption from our cloud providers.
Access control: Role-based access in product apps; row-level protections in the database where applicable.
Audit trail: Mutating operations emit events through an audit outbox shipped to a separate audit database.
Rate limiting and abuse prevention: Public and authenticated API routes are rate limited; selected public flows use bot protection.
Payments: Card data is handled by Stripe; Eleva does not store full card numbers.
Video: Sessions run on Daily through its call server in Frankfurt, with cloud recording turned off. Each invitee gets their own join link.

Data location

Primary application database: Neon, AWS eu-central-1 (Frankfurt).
Serverless functions: Vercel fra1 (Frankfurt) where configured.
File storage: Cloudflare R2, EU jurisdiction buckets.
Error monitoring: Sentry with EU data storage when configured to de.sentry.io.

Some vendors still process metadata in the United States under their DPA and Standard Contractual Clauses; see the privacy notice and sub-processor list.

Reporting issues