Effective October 26, 2026.
Every connection to everything · anesthesia is encrypted, and browsers are told never to connect any other way. The database and its backups are encrypted at rest with AES-256, and the link between our server and the database is encrypted too.
The most sensitive records are locked a second time, with our own keys kept apart from the database: credential and identity documents, the sensitive vault and tax fields (Social Security numbers and birth dates among them), every message, every school record (advising notes, concerns, evaluations, absences) and two-step sign-in secrets. Each school's files are locked under that school's own key.
Passwords are never stored, only salted one-way hashes, and the raw NPI is discarded after verification; only its one-way hash is kept. A password found in a public breach is refused, and repeated wrong tries lock the account for longer each time. You are told about every sign-in from a new device and every change to your two-step sign-in, and those notices cannot be turned off. Two-step sign-in and passkeys are available to every member.
Card numbers never reach our servers: payments run through Stripe. Case logs have no patient fields, and no patient information is stored. Access to the identity mapping is limited and its use is auditable. We'll notify you of a breach affecting your data as the law requires.
Each program is walled off from every other, twice: by the app, and by the database itself, which refuses one school's student records to anyone signed in at another. Before every release about 10,000 checks try to cross that wall as eight kinds of outsider.
Every faculty and staff account signs in with two steps. Every time staff open a student's record, it is logged, and every export carries a stamp line naming the program, who exported it and when.
Programs can ask us for our completed security questionnaire (HECVAT Lite) at [email protected]. The companies that run parts of the service for us are named in the Privacy Policy, under "Who we share with".
We do not sell member data, and it is never used to train an AI model. When you use Cerebro or another AI feature, our AI provider, Anthropic, answers under commercial terms that do not permit it to train on what you send.
There is no master key. The live server refuses one if it is ever set, and refuses every switch meant only for testing; its public status page lists anything it refused.
When you verify by NPI, we check the number against the federal NPPES registry, confirm the taxonomy is an anesthesia-appropriate clinical one, and confirm the registered name matches what you entered. That earns the NPI-verified badge.
Here is the honest limit: NPI numbers are public. Matching one proves you entered a real clinician's NPI and name — it does not, by itself, prove the person using the account is that clinician. We never display that badge as if it meant more.
Because NPI data is public, the stronger step proves you control something public data can't reach. Identity-attested (tier 2) is earned one of two ways: answering a one-time code we send to an email address at your hospital, group, or program; or a manual review by the platform owner for early members without a reachable work address.
You can attach a scan of your license or certificate to a manual review. It is encrypted before it is stored; AI reads its fields to help the reviewer check it, and a person makes the decision.
A further tier using a third-party identity-verification vendor (government ID + liveness) is designed but not yet offered — we'll add it when it's worth the cost, and we won't pretend it exists before then.
This is the security property we can state plainly and keep. The mapping between your real identity and your anonymous activity is access-controlled and is never joined to anonymous content in any query, screen, log, export, or API response. When an anonymous post leaves our servers, it carries a per-thread codename and no account identifier — not to other members, not on moderator screens, not in exports.
We keep the mapping in our database for two reasons only: letting you in, and enforcing the rules (a ban is anchored to the identity, so it can't be dodged with a new handle). Revealing who is behind a handle is restricted to the platform owner, requires a stated reason, and is permanently recorded.
We do not claim to encrypt your NPI as a security feature — it is public data, and saying so would be misleading. We do not claim NPI verification proves who is at the keyboard. And we cannot promise anonymity against valid legal process: a court order can compel disclosure, and we tell you that rather than imply otherwise.
Write to [email protected] and we answer. The same address is our published security contact (everything-anesthesia.com/.well-known/security.txt).
© 2026 EVERYTHING Brand LLC. All rights reserved. Content is fingerprinted and monitored.