1. Our Approach
liaisonIQ is a business tool for field teams. It is built to hold business data such as targets, visits, tasks, and referral counts, and not patient information. We design access, storage, and development practices around protecting that data. This page describes what we do today. See our Privacy Policy for how data is collected and used.
2. Access Control
Access is limited by role and by workspace.
- Role-based access. Workspace Owners, Admins, Field Reps, and View Only users each see only what their role allows. Server-side checks enforce this on every request, not just in the app.
- Workspace separation. Data requests are scoped to the workspace, site, and territory a user is assigned to.
- Analytics access levels. Owners choose, per member, whether they see workspace-wide, assigned-only, or no manager analytics.
- Owner controls. Owners manage members, roles, sites, and who can use features such as the AI campaign planner.
3. Authentication and Sessions
Sign-in uses Firebase Authentication (email, Google, and Apple). Identity tokens are verified on the server in every environment. The server also keeps a record of each signed-in session, so a session can be revoked and a revoked or expired session is rejected. We never store passwords in plain text.
4. Encryption
- In transit. Connections to the app and API use HTTPS, and the API sends an HTTP Strict Transport Security header.
- Sensitive fields. We apply additional application-level encryption to sensitive free-text fields, such as visit notes and AI-generated summaries, before they are stored.
- Integration credentials. Tokens for connected accounts (for example Google Sheets) are stored encrypted.
5. Audit Logging
Workspace activity is recorded in audit logs. Access to account data by our own staff for support or security is limited to authorized people, logged, and audited. Platform administrator accounts support multi-factor authentication.
6. Application Protections
- Rate limiting on the API, including stricter limits on AI features and on code-based sign-in steps.
- Standard security headers on API responses, including protection against clickjacking and content-type sniffing.
- Outbound webhooks are checked so they cannot be used to reach private or internal network addresses.
- Obvious identifiers (such as emails, phone numbers, and ID numbers) are masked before text is sent to an external AI model. See our AI Usage Policy.
- Visit check-in and check-out coordinates are removed 12 months after the visit.
7. Secure Development
Every code change is checked automatically before it is merged:
- Dependency vulnerability scanning for backend and frontend packages.
- Static security analysis of the backend code.
- Secret scanning to catch credentials committed by mistake.
- An automated access-control scan that blocks new unprotected endpoints.
- Automated tests for authentication, sessions, and access control.
8. Patient Information
liaisonIQ is not designed to store protected health information and is not a HIPAA business associate. Users must not enter patient information. See the Terms of Service and Privacy Policy.
9. Hosting and Vendors
The service runs on third-party cloud infrastructure and uses providers for authentication, payments, email, maps, and AI. The providers that may process your data are listed in our Privacy Policy. We do not currently hold a third-party security certification such as SOC 2 or ISO 27001.
10. Incidents
If a breach affects your personal information, we will notify you as described in our Privacy Policy.
11. Reporting a Vulnerability
If you believe you have found a security issue, email support@liaisoniq.app with the subject line "Security" and enough detail to reproduce it. Please do not access other users' data, disrupt the service, or publish details before we have had a chance to respond. We will acknowledge reports and work to fix valid issues.
12. Contact
Questions about security? Contact support@liaisoniq.app.