Security
Your clinic's records, kept to your clinic.
Clinics trust us with medical records, client details and their takings. This page lists the protections Vetlyn has in place today, how they work, and what we haven't built yet.
At a glance
In place todayData region
EU, Frankfurt (Germany)
Database
Supabase Postgres with row-level security
Sign-in
Password plus optional authenticator app
Audit trail
Append-only, owners and admins
// How it works
Nine layers between your records and everyone else.
Each clinic walled off in the database
Vetlyn stores data in Supabase Postgres. Every table that holds clinic data has row-level security, so a signed-in user can only read or change rows that belong to a clinic they are a member of. The check runs in the database itself, not only in the app.
Role permissions, checked twice
Each team member is an Owner, Admin, Vet, Nurse or Reception. What a role may do is checked by the server before every change and again by the database's own rules. For example, only owners, admins and vets can write prescriptions, and salaries are visible only to owners and admins.
Two-factor sign-in
Anyone can turn on two-factor sign-in with an authenticator app in Settings. Once it is on, the database refuses changes to clinical, money and team records from a session that hasn't completed the second step. You can also sign out every other device at once.
An audit trail nobody can edit
Changes to visits, SOAP notes, prescriptions, vaccinations, patients, clients, bills, payments, stock, services and the team are recorded with who, when and what changed. Entries can be added but never edited or deleted. Owners and admins can review the full trail.
Signed records stay signed
When a vet signs and locks a visit, the database stops further edits to the visit and its prescriptions and vaccinations, and stamps the signing time. Only an owner or admin can reopen it.
Private files
Attachments such as lab reports and X-rays live in private storage that only your clinic's members can reach, and open through signed links that expire after an hour.
Encrypted connections and passwords
All traffic to Vetlyn uses HTTPS, and our database provider encrypts stored data at rest. Passwords are hashed by our sign-in provider; we never see them. If you connect your own WhatsApp, SMS or email account, those credentials are stored encrypted.
Owners see care, not notes
In the pet owner app, owners see the vaccine card, bills and summaries of signed visits, never your clinical notes. The public certificate check shows the pet and its vaccines, never the owner's details.
Your data, whenever you want it
From Settings, download CSV files of clients, patients, appointments, visits, vaccinations, prescriptions, invoices, payments, products and expenses, or a full JSON backup of the whole clinic.
Good to know
The honest small print
What isn't in place yet, or works differently from what you might expect.
- 1
Two-factor sign-in is optional
We strongly recommend it for owners and admins. There are no recovery codes yet, so keep your authenticator app backed up, and contact us if you lose access.
- 2
AI requests go to our AI provider
When a vet uses Draft with AI or Ask your clinic, the text needed for that request is sent to Anthropic to write the reply. Nothing the AI drafts is saved until a person saves it.
- 3
Closing an account is done by email
To delete a clinic, email hello@vetlyn.co. Export your data first; we then delete it from the live system, and our providers' routine backups expire on their own schedule.
- 4
No formal certifications yet
We don't hold certifications such as ISO 27001 or SOC 2. This page lists exactly what is in place instead.
Questions about security?
Email hello@vetlyn.co and a person from the team will answer. To report a vulnerability, include the steps to reproduce it.