Data Encryption
In Transit
All API communications are encrypted using TLS 1.3, the latest and most secure transport layer protocol. We enforce HTTPS for all connections and use certificate pinning for additional security.
At Rest
Any data we store (account information, usage logs) is encrypted using AES-256 encryption. Database backups are also encrypted and stored in geographically distributed locations.
API Keys
API keys are hashed with SHA-256 before storage and compared in constant time. We never store plaintext keys. When you create a new key, it's displayed once and cannot be retrieved again.
Data Privacy & Handling
Zero Query Retention
Medical queries sent to our API are processed entirely in memory. We do NOT store, log, or retain the content of your API requests. Once a response is delivered, all query data is immediately discarded.
No Training on Your Data
Your API queries and data are NEVER used to train or improve our AI models. Your data remains your data—we simply process it and return results.
Minimal Data Collection
We only collect data necessary to operate the service: account information, usage metrics, and billing data. We follow data minimization principles throughout our platform.
Infrastructure Security
- SOC 2 Type II Compliant Hosting
Our infrastructure is hosted on platforms with SOC 2 Type II certification, ensuring rigorous security controls.
- DDoS Protection
Enterprise-grade DDoS mitigation protects against volumetric and application-layer attacks.
- WAF (Web Application Firewall)
All traffic is filtered through a WAF to protect against common web vulnerabilities and attacks.
- 24/7 Monitoring
Continuous monitoring for security events, anomalies, and potential threats with automated alerting.
- Regular Security Audits
We conduct regular penetration testing and security audits by independent third parties.
- Isolated Environments
Production, staging, and development environments are strictly isolated to prevent data leakage.
Access Control
Authentication
Sign-in is passwordless. We email a single-use, short-lived magic link, issued only to addresses on an approved access list — so there are no passwords to phish, leak, or reuse. Sessions are short-lived JWTs whose signature, audience, and expiry are verified on every request.
API Key Security
API keys can be scoped to specific permissions, rotated at any time, and immediately revoked if compromised. Each key has its own rate limits and usage tracking.
Internal Access
Employee access to production systems follows the principle of least privilege. All access is logged, reviewed, and requires multi-factor authentication.
Compliance & Certifications
HIPAA Alignment
While Chewie is designed as a developer tool, we follow HIPAA-aligned security practices. Business Associate Agreements (BAA) are available for enterprise customers.
GDPR Principles
We adhere to GDPR principles including data minimization, purpose limitation, and user rights. Users can request data export or deletion at any time.
SOC 2 (In Progress)
We are actively pursuing SOC 2 Type II certification for our own operations. Contact us for current compliance documentation.
Vendor Security
All third-party vendors are vetted for security compliance. We maintain a vendor risk management program and require security attestations.
Incident Response
We maintain a comprehensive incident response plan that includes:
- 24/7 on-call security team
- Defined escalation procedures and response playbooks
- Customer notification within 72 hours of confirmed breaches
- Post-incident analysis and remediation
- Regular tabletop exercises and drills
Security Best Practices for Developers
When integrating with Chewie's API, we recommend:
- 1Store API keys securely
Use environment variables or secret managers. Never commit keys to version control.
- 2Rotate keys regularly
Implement key rotation policies. Use our key rotation feature for zero-downtime updates.
- 3Use scoped keys
Create separate keys for different environments and applications with appropriate scopes.
- 4Monitor usage
Use our dashboard to monitor API usage and set up alerts for unusual activity.
- 5Validate inputs
Sanitize and validate all data before sending to the API to prevent injection attacks.
Report a Vulnerability
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:
Email: [email protected]
PGP Key: Available upon request
We commit to acknowledging reports within 24 hours and providing regular updates on remediation progress. We do not pursue legal action against researchers who report vulnerabilities responsibly.
Contact Security Team
For security-related inquiries, compliance documentation, or to request a BAA, contact: