Version: 2.1
Audit Summary: 96/100 compliance achieved
Last Updated: April 28, 2026
Next Audit: Q1 2027 (Third-Party Penetration Testing)
Versioning Note: Supersedes v2.0
1. Overview
This public summary outlines REMEDIO’s current security posture, internal review practices, and third-party audit planning.
All systems, from infrastructure to mobile apps, follow strict security and privacy guidelines aligned with GDPR and OWASP standards.
Audit Scope:
- Infrastructure Security (OVHcloud – EU)
- Network Security (firewall, TLS, HTTPS)
- Application Security (authentication, authorization)
- Cryptography (end-to-end encryption, password hashing)
- Database Security (access controls, encryption at rest)
- Mobile Security (iOS and Android)
- Privacy Compliance (GDPR, CCPA)
2. Highlights of 2025 Internal Audit
| Category | Result | Summary |
| Infrastructure Security | ✅ Excellent | Hardened servers, restricted SSH, firewall active, automatic security updates. |
| Network Security | ✅ Excellent | TLS 1.3 enforced, A+ SSL Labs rating, strong HTTP headers. |
| Application Security | ✅ Strong | Secure password policy, encryption, validated inputs, no sensitive data logged. |
| End-to-End Encryption | ✅ Complete | AES-256-GCM, PBKDF2, ECDH key exchange; master keys never leave the device. |
| Database Security | ✅ Excellent | Local-only access, encrypted backups, fine-grained privileges. |
| Mobile App Security | ✅ Robust | Certificate pinning, secure key storage, HTTPS-only, obfuscation enabled. |
| Privacy & Compliance | ✅ Full | 100% GDPR/CCPA aligned, data portability, deletion, and zero data selling. |
| Monitoring & Backups | ⚙️ Good | Automated daily encrypted backups; offsite redundancy in roadmap. |
| Planned Improvements | 🚧 In Progress | Two-factor authentication (2FA), enhanced disaster recovery plan, offsite backups. |
3. Cryptography Overview
REMEDIO implements modern cryptographic standards:
- End-to-End Encryption (E2EE): AES-256-GCM with unique initialization vectors per record.
- Key Derivation: PBKDF2 (600,000 iterations, unique salt per user).
- Family Sharing: ECDH P-256 elliptic curve secure key exchange.
- Password Hashing: scrypt (N=2^19, r=8, p=1).
- Zero-Knowledge Principle: Only users hold their encryption keys.
- Recovery Kit: 24-word seed phrase for E2E recovery.
Sensitive data such as health metrics, diary notes, and shared family health records remain unreadable even to REMEDIO servers.
4. Privacy & Compliance
- GDPR Compliance: Data export, deletion, consent, and retention procedures fully documented.
- CCPA Compliance: Rights to access, delete, and non-discrimination enforced.
- No Data Selling: REMEDIO never sells or shares personal data for marketing.
- Data Retention Policy: Active and deleted user data lifecycle managed as per Data Retention Policy.
- Breach Protocol: Notification within 72 hours (GDPR Art. 33).
5. Monitoring & Backups
- Encrypted Backups: Performed daily with 30-day retention.
- Intrusion Protection: Automated blocking of unauthorized access attempts.
- System Updates: Continuous OS, Node.js, PostgreSQL, and package maintenance.
- Planned Enhancements: Offsite encrypted backup, external uptime monitoring, and automated alerts.
6. Security Metrics (KPIs)
| Metric | Target | Status |
| Critical patch deployment | <48 hours | ✅ |
| SSL Labs Grade | A+ | ✅ |
| OWASP Top 10 Coverage | 100% | ✅ |
| Mean Time to Detect | <24 hours | 🚧 In monitoring |
| Mean Time to Respond | <72 hours | 🚧 In monitoring |
| GDPR Breach Notification | <72 hours | ✅ |
7. Upcoming Security Initiatives (2027 Roadmap)
- ✅ Two-Factor Authentication (2FA) implementation
- ✅ Cloudflare CDN + DDoS mitigation
- ✅ Offsite backup encryption (EU S3)
- ✅ External Penetration Test (Q1 2027)
- ✅ Disaster Recovery Plan (documented & tested)
- ✅ Independent third-party audit and certification
8. Independent Audits
Internal audits: Quarterly
External penetration testing: Annually (Next: Q1 2027)
Auditable scope: Infrastructure, backend, APIs, and mobile clients
REMEDIO’s security and privacy framework is transparent, standards-based, and independently auditable.
9. Contact & Reporting
If you are a researcher, security professional, or regulatory body and wish to review our framework or report a vulnerability:
📧 reportfraud@remedio-app.com
📧 dpo@remedio-app.com
We welcome responsible disclosure and independent review.
End of Public Security Audit Checklist
Version: 2.1 · Updated: April 28, 2026