Security

You practise here by talking to a camera about things that matter to you, so it is fair to ask how that is protected. This page describes what we actually do, not a certification we do not hold. We are a small team, and we would rather tell you the truth about that than imply an enterprise security programme we have not built.

2. Sign-in

• Sign-in is Google OAuth only. We never receive, and never store, a password, so there is no password database here to breach, and your Google account's own two-factor authentication protects your access.
• Session cookies are marked secure and HTTP-only in production, so they are only ever sent over HTTPS and cannot be read by page scripts.
• Every state-changing form is protected against cross-site request forgery.

3. Payments

Card payments go directly to Stripe, a PCI-DSS Level 1 service provider. Card numbers never touch our servers; we store only a reference to the Stripe transaction. Purchases are made idempotent by a unique constraint on the Stripe checkout session, so a retried or duplicated webhook cannot double-charge or double-credit you. A checkout also belongs to the account that started it: what you bought is read back from Stripe's own record, never from anything the browser sends, and a forwarded “payment successful” link cannot move your credits onto someone else's account.

4. Your sessions

• Sessions are recorded, and a recording of your face and voice is the most sensitive thing we hold. It is treated accordingly: encrypted at rest with managed keys, stored in private storage that is not reachable from the public internet, and served only through short-lived links issued to the account that owns it. A link that leaks stops working; the object behind it was never public.
• Recordings expire on a schedule, not on our good intentions. Deletion after the retention period in the Privacy Policy is enforced by a storage lifecycle rule rather than by someone remembering to run a script.
• We used to argue here that the safest data is the data that does not exist, which was true while we kept no footage. It is no longer available to us as an argument, and we would rather say so than quietly delete the sentence, recording buys you better feedback and costs you a real increase in what a breach here would expose.
• Live video runs over WebRTC between your browser and our video provider, encrypted in transit.
• Session pages are access-controlled per user: a session, station, transcript, or feedback page can only be opened by the account that owns it.
• Callbacks from our video provider are authenticated with a shared secret, so a third party who learned a conversation identifier cannot inject a fake transcript for scoring.
• Error messages stored for debugging are scrubbed of anything resembling an API key or token before they are written down.

5. Infrastructure

• Hosted on Amazon Web Services (US East), on managed services, Elastic Beanstalk for the application, RDS PostgreSQL for the database.
• HTTPS everywhere, enforced at the CloudFront edge, with HSTS set to one year including subdomains.
• Standard browser hardening headers: content-type sniffing disabled, clickjacking protection on.
• Credentials and API keys live in AWS Secrets Manager, not in source control or environment files in the repository.
• Deployments run from CI using short-lived federated credentials; there are no long-lived cloud access keys stored in our build system.
• Database access is restricted to the application; we do not expose it publicly.

6. Data you control

You can deactivate your account from your profile at any time. That starts a 30-day grace period, after which your data is purged, including asking our video provider to delete its own records of your conversations, so you do not have to chase them yourself. You can also have an individual recording deleted without losing the feedback built from it. That is an email to privacy@whitecoatprep.com, and only an email: there is no button for it in the product, and we would rather tell you that than point you at one that does not exist. The detail is in the Privacy Policy.

Consent is enforced in code, not by convention. Every purpose you can agree to is written to an append-only ledger with the policy version in force at the time, and the one function that selects accounts for any data leaving the company reads that ledger, an account that never opted in cannot be selected, and there is no second path around it. That is what lets us stand behind the promise in section 5 of the Privacy Policy instead of merely making it.

7. What we do not claim

Being straight with you about the gaps:

• We are not SOC 2, ISO 27001, or HIPAA certified, and we do not claim to be. The service is interview practice; it is not a place for real patient information, and you should never enter any.
• We have not commissioned an independent third-party penetration test. If that changes, this page will say so.
• We rely on the security of our providers, Google, Tavus, OpenRouter, Stripe, AWS, Loops, and Sentry, and their practices are theirs, described in their own documentation.
• No system is perfectly secure. If we ever suffer a breach affecting your personal information, we will notify affected users and the relevant privacy regulator as the law requires, and we will tell you what we know rather than the minimum we can get away with.

8. What you can do

• Turn on two-factor authentication for the Google account you sign in with. It is the single most useful thing protecting your access here.
• Sit sessions somewhere private, and check what your camera can see behind you.
• Never put real patient information, or anyone else's personal details, into a session.
• Sign out on shared computers.