Trust & Security

What data we handle

DeviceWatch monitors publicly available FDA adverse event data (MAUDE, via openFDA). We do not collect, store, or process protected health information (PHI), and we do not hold your proprietary clinical or quality records.

The data associated with your account is limited to:

• Account & organization data — names, email addresses, roles, team membership
• Monitoring configuration — the product codes and competitors you choose to track
• Generated content — AI summaries derived from public FDA narratives, reports, and digests

Billing is handled entirely by Stripe; we never store payment card data.

How we protect it

• Encryption everywhere — all data is encrypted in transit (TLS) and at rest.
• Access controls — role-based access, organization isolation, and least-privilege invitations. Users only see data for organizations they belong to.
• Session security — automatic session timeouts and CSRF protection on all state-changing requests.
• Audit trails — compliance-critical actions are recorded in immutable audit logs, supporting our customers' 21 CFR Part 11 workflows.
• Monitoring — application errors and security events are continuously monitored.
• Rate limiting & abuse protection — platform-layer edge rate limiting and always-on DDoS mitigation, plus application-layer quotas on our public API.
• Data retention — configurable retention policies with scheduled cleanup.

Compliance posture

• 21 CFR Part 11-ready features — DeviceWatch provides immutable audit trails, access controls, and session management to support customers operating under FDA electronic records and signatures requirements.
• DPA & SIG Lite — a Data Processing Agreement (DPA) is available for enterprise customers, and we complete a SIG Lite (Standardized Information Gathering, Lite) questionnaire on request. Because DeviceWatch monitors public FDA data and does not store PHI, our security risk profile is low, and these two documents cover what most procurement teams need.

Our infrastructure

DeviceWatch runs on established cloud providers, plus one piece of infrastructure we operate ourselves:

• Vercel — application hosting, and scheduled jobs including alert delivery, email digests and collection of recalls and 510(k) clearances
• Supabase — database & authentication
• Stripe — payment processing
• Anthropic (Claude) — AI analysis of public FDA narratives. For email digest summaries and PSUR and PMS report drafts, it also receives the labels of the products and competitors you monitor, earlier AI findings on their events and, for reports, event counts by severity, failure mode and review status. It receives no account names or email addresses.
• Resend — email delivery
• Sentry — error monitoring
• GitHub (Actions) — twice-weekly collection from FDA's MAUDE bulk files for the product codes you monitor
• DeviceWatch worker server — weekly openFDA collection, the daily AI analysis batch and an immediate delivery attempt for any critical alert that batch raises, run by us in a private network with no inbound internet access

Each cloud provider maintains a SOC 2 Type II report. GitHub's is scoped to GitHub Enterprise Cloud, which we do not use. Our own worker server is not covered by an external audit. We describe its controls in our security questionnaire, available on request.

Reporting a vulnerability

If you believe you've found a security issue, please email security@devicewatch.app. We investigate all reports promptly and will keep you informed of our progress.

Questions?

Enterprise customers and procurement teams can request our security whitepaper, a completed security questionnaire, or a DPA at security@devicewatch.app.