Security

Effective 18 October 2026 · Updated 29 October 2026 (wording now covers any owner-run business)

Protections at a glance

In transit	Every connection uses HTTPS (TLS 1.2 or 1.3). Browsers are told to use HTTPS only (HSTS). Plain HTTP is redirected.
At rest	The database sits on an encrypted DigitalOcean Volume. Clinical notes and the keys and tokens used to connect other services are additionally encrypted by Switchboard itself with AES-256-GCM before they are written. Backups are encrypted with AES-256.
Sign-in	Unique account for every person. Passwords are at least 12 characters and stored only as one-way bcrypt hashes. Two-step sign-in with an authenticator app is required for owners and administrators. Five wrong attempts lock an account for 15 minutes.
Access	Four roles with least-privilege permissions. Roles are checked on every request, so removing someone takes effect at once. Front-desk accounts cannot open clinical notes.
Logging	Sign-ins, failed sign-ins, role changes, reading clinical notes, data exports and deletions are written to an activity record.
Servers	Firewall allowing only SSH and web traffic, keys-only SSH, automatic blocking of repeated failed logins, automatic security updates. The database is not reachable from the internet.
Changes	Every release is checked against the exact code it was built on, backed up first, loaded in a test container before going live, and rolled back automatically if the app does not come up.
Your data	A business can download or permanently erase everything held about one person from inside the app. See the data retention and deletion policy.

Our policies

• Information security policy
• Access control policy
• Incident response plan
• Data retention and deletion policy
• Privacy policy

Social messaging platforms

When a business connects Facebook Messenger, Instagram or TikTok, Switchboard receives only the messages sent to that business's own business account, so the business can read and answer them. We use them for nothing else: no advertising, no sale, no combining with other sources, no profiling and no training of AI models. Access tokens are stored encrypted, a business can disconnect at any time, and a person who messaged a business can ask for their messages to be deleted. Incoming messages from Meta and Acuity are accepted only if their cryptographic signature checks out.

Who else handles the data

DigitalOcean	Hosts the server and the encrypted volume. Maintains its own independent security audits; see its published trust documentation.
Cloudflare	Domain name and email routing for our own addresses. It does not receive client messages.
Services the business connects	Its booking system (Acuity), email provider, Meta and TikTok, as the business has set them up.
An AI provider, if switched on	Off unless the business owner turns it on and supplies its own key. When on, the recent messages of the conversation being worked on are sent to that provider. See the privacy policy.

Assurance, plainly

Switchboard is a small service run by one person. We have not been through a SOC 2 or ISO 27001 audit, and we have not yet commissioned an independent penetration test; we plan one once the service supports several businesses. In the meantime we scan the software's dependencies and the server's container images for known vulnerabilities on a schedule and before releases, keep the results, and fix serious findings on the timelines in our information security policy.

Reporting a security problem

If you think you have found a weakness, or you believe something has gone wrong with someone's information, write to support@theswitchboardinbox.com with the subject "Security". We read these ourselves, reply within two business days, and will not take action against anyone who reports a problem in good faith and does not access, change or keep other people's data. Machine-readable contact details are in our security.txt.