Security Statement

Health records are among the most sensitive data anyone holds. This page sets out what we actually do to protect them — not aspirations, but the controls that are in place.

Separation between practices

Every practice runs in its own dedicated database. Patient data is not pooled into shared tables with a customer identifier column, which is the design most commonly responsible for one customer seeing another's data. Tenant context is resolved on every request from the authenticated session, and a request that cannot establish it is refused rather than defaulted.

Encryption

• All traffic is encrypted in transit using TLS 1.2 and TLS 1.3 with modern cipher suites. Plain HTTP is redirected and HSTS is enforced.
• Backups are encrypted at rest and stored separately from the live system.
• Passwords are stored only as salted one-way hashes. We cannot read your password and will never ask you for it.

Access control

• Role-based, default-deny. A user sees only the parts of the system their role requires. Anything not explicitly granted is hidden and refused, rather than merely hidden in the interface.
• Field-level masking. Identifiers such as Omang numbers and bank details are masked from roles that have no need to see them, even inside records those roles may otherwise open.
• Site scoping. Practices with more than one branch control whether data is shared between branches or kept separate.

Authentication

• Two-factor authentication using a standard authenticator app, enforced at first login for every new user.
• Password policy aligned to ISO/IEC 27001 practice: minimum length, complexity requirements, reuse prevention against recent passwords, and scheduled expiry.
• Account lockout after repeated failed attempts, and rate limiting on the login endpoint to blunt brute-force and credential-stuffing attempts.
• Sessions are bound and expire; tokens are short-lived and refreshed.

Audit trail

Bupilo keeps a tamper-evident, hash-chained audit log. Every record viewed and every change made is recorded with the user, the time, the record and — for key clinical and financial tables — the individual fields that changed and their before and after values. Because entries are cryptographically chained, a record cannot be quietly altered or removed after the fact without the chain failing verification.

This exists so that a practice can answer, with evidence, the question "who looked at this patient's file, and when?"

Payments

Every online payment is initiated by you from inside your own authenticated account, always against an invoice already issued to your practice. We verify each payment directly with the provider on their server before crediting your account — a browser redirect is never treated as proof of payment, because the customer's browser can be manipulated. Confirmations are also replay-protected, so a repeated notification cannot double-charge or double-credit an account.

Hosting and infrastructure

• Hosted in a certified data centre in France (EU), with physical security, redundant power and network, and an EU data-protection regime.
• Servers are hardened: minimal exposed services, a restrictive firewall, mandatory access control, no password-based administrative access from the public internet, and automatic security patching.
• Administrative access to production is restricted to named personnel over a private network, and is logged.
• Daily encrypted off-site backups, with restores tested — a backup that has never been restored is not a backup.
• Continuous monitoring and alerting on availability, capacity and anomalous activity.

Application security

• Parameterised database queries throughout, to prevent SQL injection.
• Output encoding and a content security policy to prevent cross-site scripting.
• Security headers enforced at the edge, including HSTS, referrer policy, and MIME-type and framing protections.
• Uploads are type- and size-restricted and are stored outside the web root.
• Dependencies are monitored for known vulnerabilities and patched.
• We periodically run a full security review of the platform and remediate what it finds.

Regulatory alignment

• Botswana Data Protection Act, 2018 — lawful basis, controller and processor roles, individual rights, cross-border transfer safeguards, and 72-hour breach notification. See our privacy policy.
• ISO/IEC 27001 practice — access control (A.9), cryptography (A.10), operations security (A.12) and logging and monitoring, applied as our working standard.
• PCI-DSS — met by scope reduction. Bupilo does not store, process or transmit cardholder data; that responsibility sits entirely with our PCI-DSS-compliant payment providers.

Incident response

If a security incident affects your data, we will tell you without undue delay and within 72 hours of becoming aware of it. You will be told what happened, what data was involved, what we have done, and what we recommend you do. We notify the Information and Data Protection Commission where the law requires it, and we support you in meeting your own notification obligations.

Your part

Most breaches in healthcare are not sophisticated attacks — they are shared logins and unlocked screens. To keep your practice safe:

• Give every staff member their own login. Never share credentials.
• Complete two-factor enrolment and keep the device secure.
• Remove users the day they leave, or the day their role changes.
• Grant the narrowest role that lets someone do their job.
• Lock workstations at reception and in consulting rooms when unattended.
• Review the audit trail periodically. It only helps if someone looks at it.

Reporting a vulnerability

If you believe you have found a security vulnerability in Bupilo, please tell us at security@bupilo.co.bw. We will acknowledge your report within two business days and keep you informed while we investigate.

We ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly, that you do not access, modify or delete data belonging to any practice, and that you do not degrade the service. We will not pursue legal action against researchers who follow these principles in good faith.

Questions

Practices carrying out their own due diligence are welcome to ask for more detail — including our data processing agreement, backup and restore procedures, and incident response plan. Write to security@bupilo.co.bw.