Overview
Vetaverse handles sensitive veterinary business data — PIMS sales exports and profit & loss statements. We protect that data with private storage, tenant isolation, authenticated APIs, and careful use of AI for narratives only.
Recent releases were security-reviewed with Cursor AI (including Fable) and Bugbot for authentication, storage access, and practice isolation. That is an engineering review process — not a third-party certification such as SOC 2 or a formal penetration test.
Controls in place
One Account authentication
Sign-in uses Auth0 (auth.dvm.com) — One Account shared with VetGPT. Passwords and social login are managed by Auth0, not stored in Vetaverse application code.
Auth-gated uploads
PIMS and P&L upload and analysis routes require a signed-in user. Practice ownership is checked before storage paths and analysis run.
Practice isolation
Reports, findings, and uploads are scoped by practice_id. Authenticated users only access practices linked to their account (by email / ownership).
Private file storage
Original PIMS and P&L uploads are stored in a private Supabase Storage bucket. Files are not publicly listable or downloadable via permanent URLs.
Signed downloads only
Admin downloads use short-lived signed links (about one hour). We do not expose public object URLs for practice financial files.
Admin allowlist
Support and /admin tools are limited to an explicit email allowlist.
Paid Gemini API
Narrative insights use Google’s paid Gemini API with aggregated summaries (KPIs, product names, findings). Paid API content is not used to train Google’s models. Client names are not sent in PIMS narrative prompts.
Financial reports only
Designed for standard PIMS sales exports and P&L statements — not live PIMS integrations or full medical records.
Network learning opt-in
Cross-practice P&L label learning is off by default. Practices only contribute anonymized account labels when explicitly opted in.
Admin access
Platform administration is limited to an explicit email allowlist. Admins use service-role APIs server-side only to support practices and review uploads — not a shared “superuser” password in the browser.
What we are not
Vetaverse is a business intelligence tool, not a covered entity under HIPAA by default. We do not offer a Business Associate Agreement (BAA) unless separately contracted. Upload financial and operational exports — not protected health information — unless you have independently assessed compliance for your use case.
Report a concern
If you believe you have found a security issue, contact hello@vetaverse.ai. Please include steps to reproduce and avoid sharing live practice files in email when possible.