Your data

Your medical records, handled like they matter.

Reys holds service treatment records, provider notes and personal health information. The architecture assumes those files are among the most sensitive a person owns — because they are.

Protection

How your documents are stored.

◆

Encrypted at rest with dedicated keys

Documents and extracted health information are encrypted using dedicated, separately managed encryption keys rather than a single shared key across the whole system. Document storage and application data are separated.

◆

Encrypted in transit

All connections use HTTPS. There is no unencrypted path to your records.

◆

Private storage, no public access

Document storage is not publicly reachable. Files are served only through authenticated application requests, never from a directly accessible public URL.

◆

Isolated network boundary

The database sits inside a private network boundary and is not reachable from the public internet.

Accountability

A record of what happened, that can't be quietly edited.

If something is wrong later, you should be able to reconstruct how it got that way.

◆

Append-only audit trail

Access and changes are written to a write-once log. Entries are added, never overwritten or removed.

◆

Scheduled integrity verification

The audit chain is checked on a schedule to confirm it hasn't been tampered with, and the verification itself is logged.

Retention & control

Your records stay yours.

Fixed retention windowBackups are held for a defined period and purged automatically on schedule — not kept indefinitely by default.
Automated purgeExpired sessions, password-reset tokens and time-limited artifacts are removed by a scheduled job, not left to accumulate.
Export anytimeTake your documents with you. There is no requirement to keep using Reys to keep your own records.
Deletion on requestAsk for your account and its contents to be removed and they will be.
Not training dataYour records are not used to train models and are not sold or shared with advertisers.
No advertising trackersThis site carries no advertising pixels or third-party tracking scripts.

Being straight with you

What we don't claim.

Scope of these statements

The descriptions above reflect how Reys is built. They are not a formal security certification. Reys does not currently claim SOC 2, HITRUST, FedRAMP or any similar third-party attestation, and no such audit should be inferred from this page.

Reys is in closed beta. If you need contractual data-protection terms — a Business Associate Agreement or equivalent — contact us before uploading records rather than assuming coverage exists.

If you find a security issue, please report it to hello@getreys.com. Reports are welcome and will be taken seriously.

Questions about your data?

Ask before you upload anything. A direct answer is faster than guessing from a policy page.

Ask a question →