BrightPathTalk to us
OverviewApps & OSWorkflowsFor your teamSecurityPlatformsTalk to us

Security

Security claims should be specific and current.

This page separates controls used by the public website today from controls being built and tested for the BrightPath clinic product.

Talk to us

Security

Set access once. Keep a record of what happens.

BrightPath is being designed around encryption, role-based access, and audit history. The public website already uses HTTPS, strict security headers, local fonts, and no analytics or advertising scripts.

Website controls in useHTTPS, security headers, same-origin assets, and no visitor tracking.
Product controls in testingRole-based permissions, encryption, and activity records are part of private product testing.
Claims stay scopedCertifications and compliance claims will be published only after they are independently supported.
On this pageWebsite securityProduct securityAssurance and claimsReport a concern

Reviewed September 25, 2026

Public website security

The BrightPath marketing site is a static website served through Cloudflare. It redirects traffic to HTTPS, sends a restrictive content security policy, blocks framing, limits browser permissions, and loads its scripts, styles, images, and fonts from the same site.

The public pages do not include a contact form, payment flow, advertising pixel, or analytics script. Those absences reduce the amount of visitor data and executable third-party code on the page.

The only pages that handle an account are the sign-up pages (/auth/confirm and /start/) for people a clinic or BrightPath has invited. They send what you enter directly to BrightPath's sign-in and database service hosted in Canada, require two-step verification, keep an unfinished form only in that browser tab, and use a stricter content security policy that allows connections to that service only.

Clinic product security

The BrightPath clinic product is in private testing. Role-based permissions, encryption, activity history, account controls, backups, and recovery procedures are being developed and tested as product controls. The details that apply to a clinic will be documented in its agreement and security materials before production use.

We do not use this page to promise a control that has not been implemented, tested, and placed in the scope described here.

Assurance and compliance claims

BrightPath does not currently claim SOC 2 certification, ISO 27001 certification, HIPAA compliance, or any other third-party security certification on this website. Certifications, assessments, and jurisdiction-specific compliance statements will be listed with their scope and date only after they are supported.

Privacy obligations depend on the clinic, the information involved, the applicable law, and the agreement governing the service. Security features support those obligations; they do not transfer a clinic’s legal responsibilities to a badge or product label.

Report a security concern

Send a description to privacy@pathwaytohope.ca, our single address for security reports and privacy requests. Include the affected page or service, the date and time, steps to reproduce the issue, and a safe way to contact you. Do not send patient information, passwords, access tokens, or active exploit code in the first message.

We ask researchers to avoid accessing or changing information that is not theirs, disrupting services, or publicly disclosing an unresolved issue before we have had a reasonable opportunity to investigate.