Last updated: 4 Sep 2026
Xalyra is operated by Claudiu Coca (Romania). The technical and organizational measures in place today are below.
Production hosting, DNS and primary data storage: Romania-Webhosting (ClausWeb), Romania (EU). All clinical and patient data lives on EU infrastructure.
No third-party script, challenge or CDN runs on any page — the public forms are protected server-side, so nothing about a visitor reaches a non-EU provider.
Email delivery: Resend, EU region only.
Payment processing (opted-in businesses only): Stripe Payments Europe Ltd., Ireland (EU).
Full sub-processor list at /legal.
In transit: TLS 1.2+, HSTS (max-age 1 year), HTTPS-only cookies. Certificate via Let's Encrypt, auto-renewed.
At rest: data on cPanel-managed encrypted volumes; secrets (API keys, tokens.secret, sub-processor credentials) live only in a gitignored config file on the production host.
Backups: libsodium XChaCha20-Poly1305, key held only on the production host. The off-host backup provider sees opaque encrypted blobs.
Staff authentication: password (rate-limited), passkeys (WebAuthn), one-time email codes. TOTP planned.
Per-permission checks (e.g. patients.view, patients.medical_view, patients.delete); admins cannot grant themselves more than the owner has assigned.
Every state-changing action recorded in an append-only audit log (action, actor, entity, before/after, IP, user-agent). Retention per /legal.
Single-holder ownership: only the owner grants or removes the admin role. Master admins cannot modify each other. One platform owner with cross-clinic super-admin scope (the founder).
Off-host encrypted backups are live: full database and every clinic's files, libsodium-encrypted on the production host, uploaded to off-host cloud storage weekly. The cloud provider sees only opaque encrypted blobs.
Retention: rolling 2-bundle window — the previous bundle is purged only after the next is verified uploaded. The production host also retains the provider's own backup tooling.
Recovery objectives (target): RPO 7 days, RTO 4 hours for data-loss incidents.
72-hour breach-notification window per GDPR Art. 33. Affected businesses (controllers) will be notified without undue delay.
Businesses: contact contact@xalyra.app. Patients of a business: contact the business — they are the controller.
Report security issues privately to contact@xalyra.app. Response within 5 business days. Public acknowledgement on request; no paid bug bounty today.
Do not test on real clinics' data; a test environment is available on request.
ISO 27001 — not certified today; on the roadmap, tied to revenue milestones. We follow the same control families now (access control, cryptography, operations security, supplier relationships, incident management).
EHDS (Reg. 2025/327) — primary-use obligations begin 2027-2029. Data model maintained with EHR Exchange Format interoperability in mind.
MDR/MDSW — Xalyra is practice-management software, not a medical device. Features that would cross the MDSW threshold (AI clinical decisions, automated diagnosis) will not ship without the Class IIa+ pathway (Notified Body, ISO 13485).