Security & Responsible Use
How we protect professional records—and the boundaries that matter when sharing them.
Effective October 21, 2026
1. Professional records only
Use CredVaultMD for professional licenses, certifications, CVs and CME records. Do not upload patient information. We do not represent the service as HIPAA certified, and encryption alone does not establish HIPAA compliance or create a business associate agreement.
2. Encryption and account access
Private profile and document content uses AES-256-GCM envelope encryption with AWS KMS protecting the data keys in production. HTTPS protects transport. Application servers decrypt authorized requests to provide the service; this is not end-to-end encryption.
The current sign-in flow uses AWS Cognito with a password and authenticator-code verification. Account roles and server-side ownership checks restrict access. Session cookies are protected and sessions expire. Keep your authenticator secure and do not disclose your password, temporary password or codes to support.
3. Uploads and sharing
Uploads are checked for supported contents and size. Files without a clean malware-scanning result remain quarantined from download and sharing. OCR requires a configured provider and explicit consent to process the selected file.
Packet links expire and can be revoked. They are bearer links: possession can provide access until expiration or revocation. Share them privately. Downloaded copies remain outside our control. A file passing malware scanning is not a verified professional credential.
4. Report a security concern
Email support@credvaultmd.com with ‘Security report’ in the subject. Include a brief description, the affected page and safe steps to reproduce. Do not include passwords, keys, patient data, live packet links or another user's documents. Ask for a suitable secure transfer method if sensitive evidence is necessary.
Report suspected account compromise promptly and stop sharing affected links. Security testing must not access other people's data, disrupt service or bypass permissions. This page does not offer a bug bounty or authorize testing against third-party systems.