Encryption
TLS 1.3 everywhere
All web traffic and API calls are encrypted with TLS 1.3. HSTS is enforced; HTTP requests redirect to HTTPS. No plaintext fallback paths exist.
Security
The controls behind every booking, message, and payment.
Healthcare data deserves more than vague trust statements. Below is the inventory of the controls we have implemented — written so an auditor or your compliance officer can map it to a checklist.
Encryption
AES-256 at rest
Data is hosted in South Africa and encrypted at rest with AES-256. Backups carry the same encryption.
Authentication
Passwords bcrypt-hashed
User passwords are bcrypt-hashed at cost 10 before storage. Password reset tokens are SHA-256 hashed; the raw token only ever exists in the email link.
Authentication
Signed JWT sessions
Authentication is via short-lived JWTs signed with a server secret rotated quarterly. All authenticated API endpoints validate the signature and expiry.
Authentication
QR-attendance signed tokens
Attendance verification uses a rotating QR code containing a JWT signed by the platform with a ~2 minute expiry. Scans outside the scan window or with a stale token are rejected; valid scans are persisted as append-only rows that gate booking completion.
Audit
Hash-chained audit log
Every booking, message, payment, QR attendance scan, geofence check-in, and admin action is logged with a SHA-256 hash linking to the previous entry. Tampering is detectable by re-computing the chain.
Audit
GPS-jump anomaly flagging
When a professional checks in and out of a shift, the system Haversine-compares the two coordinate pairs and the time gap. A jump greater than 50 km within 2 hours flags the row for admin review without blocking the checkout — supporting context for any subsequent dispute.
Audit
Daily WORM snapshot
Audit logs are exported nightly to write-once (WORM) storage hosted in South Africa, with a 7-year retention policy required by SA financial regulation.
Testing
Annual penetration test
External penetration testing against the production API and web app, annually at minimum. No Critical findings open; the executive summary is available on request to security@btlocum.com.
Testing
SAST + SCA on every deploy
Static analysis and software composition analysis run on every pull request. Deploys are blocked on Critical findings; High findings are reviewed by a security engineer within 24 hours.
Access control
Role-based access control
Every API endpoint is scoped to a user role (locum, facility admin, facility staff, platform admin). Cross-tenant data access is prevented at the database query layer, not just the API.
Payments
Escrow under a licensed FSP
Payment escrow is held by PayFast, a Financial Sector Conduct Authority-licensed FSP. Funds never sit in Locum company accounts. Facilities fund escrow at shift-post time, before any professional can apply.
Payments
Cancellation holdback worker
Critical-window cancellation cash penalties are settled against the professional's next per-shift payout before the transfer is made. Each settlement writes an idempotency-protected audit row so a re-run cannot double-deduct.
Notifications
Web Push under VAPID
Push notifications use VAPID-signed Web Push. The private key sits in a server-side secret manager; the public key is exposed by /push-subscriptions/vapid-key. Dead subscriptions returning 404/410 are pruned automatically on the next send attempt.
Incident response
Documented breach response
72-hour breach notification target to affected users and the Information Regulator. Three-tier incident severity model; on-call engineer paged within 5 minutes for Sev-1 issues.
Reporting a security issue
Email security@btlocum.com with a clear description and reproduction steps. We acknowledge within 24 hours and follow responsible disclosure principles. Researchers acting in good faith are protected — we do not pursue legal action for reports that follow our disclosure policy.
Detailed disclosure policy and PGP key available at /security/disclosure.