# Security and compliance

Canonical source: [https://www.braver.net/en/security/](<https://www.braver.net/en/security/>)

## Designed for healthcare. Built for trust.

Braver lets patients and their loved ones take part in care while preserving the confidentiality of their conversations.

End-to-end encrypted Hosted in Canada TGV certified Law 25 SSO · MDM

01

“Who can see this?”

 A patient

### Your data stays yours.

Conversations, files and records are encrypted, and only the people involved have access.

- ****End-to-end encryption** Messages, calls, notes and documents.**

  Including data stored on phones and tablets.
- ****Role-based access** Access depends on the person’s function.**

  A care aide, a nurse and a physician do not see the same information. Family caregivers see what the patient has agreed to share with them.
- ****Controlled downloads** Downloads can be blocked by team.**

  A team can view files without being able to download them. Your organization decides, team by team.
- ****Verified professionals** Professional status is verified.**

  Status is confirmed before access to the network is granted.

02

“What about five years from now?”

 A records manager

### Nothing disappears by accident.

Your organization decides how long records are kept and when they are destroyed. Braver does not make that decision for you.

- ****Retention by unit** Each unit has its own retention period.**

  When the period ends, the record appears in a list for review. It is not deleted unnoticed.
- ****Nothing is destroyed automatically** Destruction is scheduled with a 30-day waiting period.**

  Someone must request it. After the waiting period, a certificate is produced and the log retains a record of the operation, without the content.
- ****Hold for litigation or an access request** A record on hold cannot be destroyed.**

  The hold is lifted once the situation is resolved.
- ****Complete record export** The full record, in PDF or JSON.**

  For an access request, a change of system or archiving elsewhere. The record belongs to you.

03

“Who opened this document?”

 A clinical manager

### You always know who did what.

Authorized people can consult the audit log at any time, without requesting a report.

- ****Audit log** Filter by unit, person or date range.**

  Clinical and administrative actions are recorded there.
- ****Views and downloads are tracked** See who opened or downloaded a document.**

  You know who viewed it, who downloaded it and when.
- ****A reason is required** Exceptional access requires justification.**

  The reason is recorded in the log with the person’s name.
- ****Versions and history** Previous versions are retained.**

  When a message or form is changed or deleted, the previous version remains available and the action is recorded.

04

“What if a phone is lost?”

 The IT team

### Accounts and devices under control.

Rules are set by user group, according to your IT team’s policies.

- ****Single sign-on (SSO)** Sign in with your identity provider.**

  Accounts can be created in bulk from your directory. When someone leaves the organization, their access is removed at the same time.
- ****Two-factor authentication** Security code by email or SMS.**

  Requested at sign-in and for certain sensitive operations, in addition to the password.
- ****Session locking** Automatic locking after inactivity.**

  The inactivity timeout and maximum session duration are configured by group.
- ****Managed devices (MDM)** You can require a device managed by your MDM.**

  For a given group, access can be restricted to devices managed by your organization, or to the web only.

These rules apply throughout Braver. Explore [see the tool in daily use](<https://www.braver.net/en/tool/>) , or [build your platform →](<https://www.braver.net/en/platform/>)

Our commitment

### Trust is demonstrated, with documentation to back it up.

1. Security documentation, compliance questionnaires, reviews with your IT teams and privacy officers: we respond in French, with the technical detail your committees require.
2. Data is hosted in Canada, and personal information governance is aligned with Law 25.
3. No AI-generated note is added to the record without review by a clinician, and your data is never used to train third-party models.

In your setting

See how it all comes together in your setting.

[Long-term care](<https://www.braver.net/en/platform/#cas=ld>) [Home care](<https://www.braver.net/en/platform/#cas=dom>) [Small clinic](<https://www.braver.net/en/platform/#cas=multi>) [Medical clinic](<https://www.braver.net/en/platform/#cas=med>) [Pharmacy](<https://www.braver.net/en/platform/#cas=pharm>) [Institution or regional network](<https://www.braver.net/en/platform/#cas=coord>)

### Your IT team has questions?

Schedule a security review with our technical team.

[Schedule a meeting](<https://www.braver.net/en/demo/>)