Controls
Medzelo uses Supabase Auth, RLS, scoped API access, service-role isolation, signed storage access where configured and audit logs for sensitive actions.
Reporting
Security concerns should be reported through support or the configured security contact. Do not test against customer data without permission.
Review
This policy is a production draft and should be reviewed with the final incident response process.