Security

The browser tools - validate, diff, convert, generate, the FHIR suite - run the parser and validator in the page. Message content is not sent to us to make them work.

Three things are server-side by definition, and each is opt-in by using it: the validation API (you POST a message to it), saved specs (examples you save travel with the spec), and the conformance probe (it calls the endpoint you name, with the credentials you supply).

The Bridge agent runs inside your network. It validates against a signed copy of your spec in its own process, and holds an API client that exposes only heartbeat, spec sync and usage reporting - so a call carrying message content is a compile error rather than a policy. A message it cannot validate locally is refused, not sent to us.

A validation request is answered from memory and leaves behind a fixed telemetry row: which share token, which spec, a salted hash of the client IP, message type, status, HTTP status, whether it parsed, size in bytes, rule and error and warning counts, response time, agent version, timestamp. Not the body, not the parsed message, not any field value.

Three controls hold that, rather than a policy document:

• One typed function writes that row, and its type has no field that could carry message content - storing any would not compile.
• Parser and validator errors can quote the input back, so errors are logged by class name through a helper that never logs the message or stack.
• A static check runs before every production build and fails it if a log or insert statement reaches for message content.

Retention runs to the plan's window and is swept daily. Full detail, field by field, is on the trust page.

• TLS everywhere; HSTS on the apex and www.
• A Content-Security-Policy whose connect-src is same-origin only, so a compromised dependency cannot exfiltrate to another host. frame-ancestors is none, plus nosniff, a strict referrer policy, and a permissions policy denying camera, microphone and geolocation.
• Sign-in is OAuth (Google, GitHub) or an emailed link. We never handle a password.
• Every org-scoped endpoint checks membership server-side against the authenticated session; an id in a request is never trusted on its own.
• Mutating requests carrying a cookie session are origin-checked. Token-authenticated API calls are not cookie-CSRF-able and are exempt.
• Agent and API tokens are stored as SHA-256 hashes. The plaintext is shown once and is not recoverable.
• The conformance probe resolves and pins the target address before connecting, and refuses private, loopback, link-local and cloud-metadata ranges, including alternate encodings of them.
• Rate limits are enforced per plan and per IP, in Postgres so they survive serverless cold starts.

There is no third-party analytics, error-reporting or session-replay SDK, and no external script or font host - product analytics are our own sink, and the event type cannot represent message content.

Dependencies are audited and the tree is kept at zero known advisories; upgrades that clear an advisory are treated as urgent rather than scheduled.

Please report privately to support@interoperall.com rather than opening a public issue. Include what you did, what you saw, and how to reproduce it. We will acknowledge, keep you updated while we fix it, and credit you if you would like that. See also /.well-known/security.txt.

We will not pursue anyone acting in good faith to report a real issue.

For a security questionnaire, a BAA, SSO, or a self-hosted Bridge agent, write to support@interoperall.com or use contact. Those are handled on Enterprise, and we would rather answer a questionnaire early than late.

Stated plainly so nothing is assumed: Interoperall is not currently SOC 2 or HITRUST certified, and we will not imply otherwise on a questionnaire. What we can give you is this page, the trust page, the controls above, and direct answers.

• Malware on the machine running the browser - that is the OS and browser sandbox's job.
• Browser-local storage is not encrypted at rest; an unlocked screen is readable.
• Anything you deliberately publish. A share portal is public to whoever holds the link.
• The conformance probe reaches whatever endpoint you point it at, with the credentials you give it. That request is yours.