We Take Security Seriously
Naveera Tech was built by operators who understand how critical reliability and privacy are in patient transportation. Our platform protects sensitive medical and operational data with modern security standards, HIPAA-aligned controls, and ongoing monitoring.
Security is not a feature — it is part of our foundation.
HIPAA Compliance
Naveera maintains administrative, physical, and technical safeguards required for the protection of PHI under HIPAA.
We implement:
- HIPAA-aligned data handling and storage practices
- Controlled access to PHI with least-privilege permissions
- Encrypted communication between systems and devices
- Audit logging for platform activity and sensitive actions
- Policies for breach notification and incident response
Business Associate Agreements (BAA) are available for covered entities.
Contact: security@naveera.tech
Data Encryption
All sensitive data is encrypted:
- In transit: TLS 1.2+
- At rest: AES-256 or equivalent
Keys are managed securely with rotation and access restrictions.
Access Controls
We restrict access to PHI and operational data to authorized personnel only.
Controls include:
- Role-based access permissions
- Multi-factor authentication for admins
- Audit trails and change tracking
- Regular credential/access review
- Least-privilege enforcement across systems
Infrastructure Security
Hosted in secure US-based environments with continuous monitoring.
We use:
- Containerized and isolated runtime architecture
- Network segmentation + firewall rules
- Automated patch and dependency monitoring
- Metrics/logging + intrusion detection
- Disaster recovery + failover planning
Application Security
Security is embedded into development workflows.
We perform:
- Code review and CI checks
- Vulnerability scanning + supply-chain review
- Rate limiting & anomaly detection
- Input validation and request filtering
- Ongoing penetration/security testing
Data is retained only for operational + compliance needs.
Backups are encrypted, redundant, and tested for recovery.
Export or deletion available at termination per policy.
Incident Response
We maintain processes to detect, respond to, and report incidents.
If PHI is ever affected, parties will be notified according to HIPAA timelines.
Urgent security or vulnerability reports:
Sub-Processors & Integrations
Naveera uses trusted partners for features like mapping, SMS, cloud hosting, and analytics — all under security obligations consistent with HIPAA expectations.
We do not sell PHI or user data.
Data Ownership & Export Rights
Customers own their operational + trip data.
Exports available in machine-readable format; deletion can be scheduled per retention laws.
Our Commitment
Naveera exists to make transportation calmer, safer, and more reliable.
We move patients with dignity — and treat their data with the same care.
Responsible Disclosure
Naveera welcomes security research that helps improve the safety of the platform.
If you discover a vulnerability, you must:
- Report it privately to security@naveera.tech
- Avoid public disclosure for 90 days without approval
- Avoid accessing PHI or user accounts without permission
We do not pursue legal action against good-faith researchers.
Ethical disclosure keeps patient data safe — thank you.