Security
Protecting customer and veteran information is a core part of how VetLogic Pro is designed. VetLogic Pro uses security controls designed to protect information against unauthorized access, alteration, loss, misuse, and disclosure.
Last Updated: September 23, 2026
VetLogic Pro’s architecture is designed around:
VetLogic Pro is designed as a multi-tenant platform. Organizations are logically separated, and authorization controls are designed to prevent one organization from accessing another organization’s Customer Data.
Documents containing veteran or organization information are intended to remain private, with access granted only to authenticated and authorized users. Uploaded documents may be automatically inspected or scanned for malware and other security threats. Files reasonably suspected of presenting a security risk may be quarantined, restricted, or rejected.
VetLogic Pro may maintain encrypted or otherwise protected backups to support availability, disaster recovery, and business continuity. Backup copies are subject to access controls and retention procedures.
Sensitive veteran documents and medical information are not included directly in routine transactional emails. Notifications instead direct authorized users to sign in to VetLogic Pro to access sensitive information.
Social Security numbers entered on forms are encrypted at the field level with a separate key, on top of the encryption protecting the rest of the record. Completed forms that contain one are stored encrypted and open only for an authorized, multi-factor-verified user, and every access is written to the audit log with the name of the person who opened it.
Every record belongs to exactly one organization. The database only returns rows that belong to the signed-in user’s organization, and it refuses to link a record in one organization to a veteran, claim or file in another. It is designed so that one organization can’t access another’s data.
Access rules are enforced inside the database with PostgreSQL Row Level Security on every table that holds organization or veteran data. Even a request that bypassed the application screens would still be limited to what that user is allowed to see.
Pages, form submissions and file requests re-check who the user is, which organization they belong to and what their role allows — on the server, for every request. Hiding a button is never the only protection.
Documents are kept in private storage that is never publicly readable. Storage access follows the same rules as the database, files are stored under random identifiers rather than names, and uploads are checked for allowed file types and size and screened for active content such as macros or embedded programs.
To open a file, the server first confirms the user may see it, then issues a temporary link that expires after 60 seconds. Veterans can only open documents your team has made visible to them, or files they uploaded themselves.
There is no public sign-up — every account starts from an invitation sent by an authorized person. All organization staff — Owners, Admins and Case Managers — must use multi-factor authentication with an authenticator app. Idle sessions are signed out automatically, and deactivated accounts lose access immediately.
All connections use HTTPS, and browsers are instructed to always use a secure connection (HSTS). Security headers, including a Content Security Policy and framing protections, limit what can run on or embed VetLogic Pro pages.
Important actions are recorded in the organization’s activity log — including document views and downloads, staff invitations, role changes and deactivations, and changes to claims, tasks and requested forms. Passwords, access tokens and other secrets are never written to the log.
An automated test suite attempts cross-organization and cross-role access against the database rules — for example, one organization reading another’s records, or a veteran reaching someone else’s files — and must block every attempt.
Role-based access
Each organization has exactly one Owner. Admins share day-to-day administration, Case Managers work cases, and Veterans see only their own information. These rules are enforced on the server and in the database.
Work veteran cases (claims, documents, tasks, appointments, messages)
Invite staff, change roles, deactivate Admins and Case Managers
Archive and restore documents
Permanently delete documents
Billing, subscription and ownership
Multi-factor authentication required
Admins can never change or remove the Owner. A veteran can remove a document they uploaded only until your team has filed it to a claim or archived it.
If you believe you have discovered a security vulnerability affecting VetLogic Pro, contact us at privacy@vetlogicpro.com.
Please do not publicly disclose a suspected vulnerability until VetLogic Pro has had a reasonable opportunity to investigate and address it.
VetLogic Pro’s security program will evolve as the platform grows. VetLogic Pro does not currently offer Business Associate Agreements and is not intended for the protected health information of HIPAA covered entities.
We describe only the controls that are built into VetLogic Pro today. If your organization has specific security or compliance requirements, bring them to your demo and we’ll answer them directly.
VetLogic Pro is an independent software provider. VetLogic Pro is not affiliated with, endorsed by, sponsored by, or operated by the U.S. Department of Veterans Affairs or any other government agency. VetLogic Pro does not make benefit determinations or guarantee the outcome of any veteran's claim. VetLogic Pro does not provide legal advice, medical advice, or claims representation.
Request a demo and we’ll walk through access controls, roles and document handling with your team.
