ElaZapPeriod tracker security
ElaZap is built for sensitive health data. We collect what the product needs, protect it at rest and in transit, and keep export and deletion straightforward.
Data protection
- Phone numbers, email addresses, display names, and free-text notes are stored encrypted at rest.
- Phone and email lookups use keyed hashes instead of plaintext identifiers.
- Authentication tokens are HTTP-only cookies with short-lived access tokens and single-use refresh rotation.
- Data exports are CSV-escaped to reduce spreadsheet formula injection risk.
Access controls
- Dashboard and private API routes require a verified session.
- Paid health tracking APIs require an active subscription or valid trial on the server, not only in the UI.
- Expired users can still export or delete their data.
- WhatsApp webhooks require Meta signature verification in production.
Infrastructure controls
- Redis is used for OTP expiry, rate limits, message deduplication, and token revocation.
- Stripe webhooks are verified with Stripe signatures before subscription changes are applied.
- Every request receives an X-Correlation-ID header for operational tracing.
- Production startup validates critical secrets and refuses unsafe runtime configuration.
Third parties
- WhatsApp/Meta carries messages between users and ElaZap.
- Stripe processes subscription payments.
- WhatsApp commands are classified locally with keyword matching. No third-party LLM.
User controls
Users can export their cycle data from the dashboard and can delete health records from their account. Deletion removes cycle, flow, symptom, prediction, and conversation-state records while retaining the minimum account and audit records needed for compliance.