MedBillCheckup

Security

MedBillCheckup handles medical bills, so the strongest control is the simplest one: your bill never leaves your device, and we store nothing. Everything on this page describes what the running software actually does.

What is in place

  • Your bill never leaves your device

    The file is read by your own browser and kept in your browser’s storage (IndexedDB). A PDF’s text layer is read directly; a scan or photo goes through text recognition that runs on your machine. It is never uploaded. There is no server that holds bills, so there is no store of bills to breach.

  • Nothing is stored on our side

    We run no database. When you run the checks, the redacted figures of your bill are processed in memory by a stateless function and the findings are returned; the function writes nothing to disk and keeps nothing between requests. Request bodies are never logged.

  • Identifiers stay on the device

    A patient’s name, account number, date of birth and insurance member ID found on a bill are separated from the figures on your device and never included in the request that runs the checks. Only line items, amounts, dates, billing codes and the provider name are sent.

  • Encryption in transit

    All traffic is served over HTTPS, and HTTP Strict Transport Security is set with a one-year max-age.

  • Proof of payment is a signed token, not an account

    After you pay, your browser holds a receipt (for one bill) or a pass (for a subscription) signed by our server. The server verifies the signature on every request without looking anything up. A receipt is bound to a hash of the exact figures you paid for, so it cannot be replayed against a different bill.

  • Payment security

    Card details never reach our servers; checkout is hosted by Stripe. A receipt or pass is issued only after Stripe confirms the payment or the subscription, and Stripe is the only record of who paid.

  • Subscriber sign-in without passwords

    A subscriber signing in on a new device receives an emailed link carrying a signed token that expires after 15 minutes. The request that asks for the link always gets the same reply, so it cannot reveal whether an email address is a subscriber. Only subscribers are ever emailed.

  • Rate limiting

    Every function is rate-limited in memory per caller, so a burst of requests for sign-in links or checks is throttled. There is no shared store, so the limits are best-effort per instance, and the email provider’s own daily cap bounds abuse further.

  • File validation on your device

    Files are validated by inspecting their actual bytes, not the type the browser claims. Only PDF, JPEG, PNG, WebP and HEIC are accepted; size and page count are capped; a malformed PDF is rejected rather than partially parsed. Because reading happens in your browser, a hostile file can only affect your own session.

  • Content Security Policy

    A strict same-origin CSP is applied to every response: scripts, workers and connections may only come from our own origin (WebAssembly is allowed for the on-device reader), with object-src none and frame-ancestors none. X-Content-Type-Options, X-Frame-Options and Referrer-Policy are set. The pages load no third-party JavaScript.

  • Documents are treated as untrusted input

    A bill can contain text that looks like instructions. The reader transcribes it as content, never as commands, and the checks that produce findings are deterministic code rather than a model. No document ever reaches an AI provider.

  • Nothing sensitive in logs or error reports

    There are no analytics. Server logs carry request ids and error codes only. If error tracking is enabled, request bodies, query strings and headers are stripped before anything is sent, so the figures of a bill cannot be included.

  • Erase everything, yourself

    Settings has one control that deletes everything the app holds in your browser: bills, results, letters, receipts, your pass and your consent choices. Because we keep nothing on our side, that is a complete erasure. You can also download all of it as a file first.

What we do not claim

We hold no security certifications. MedBillCheckup is not SOC 2 audited, not ISO 27001 certified, and not HIPAA certified (no such certification exists for HIPAA in any case). We do not describe our security as “bank-level”, because that phrase means nothing. If any of these change, this page will say so and name the auditor and the report date.

Keeping the bill on your device also means its safety depends on your device: anyone who can open your browser profile can open your bills. Use the erase control in Settings on a shared computer. The tests covering these controls were written by the same people who wrote the code; an independent security review has not yet been carried out.

Reporting a vulnerability

If you find a security problem, write to billcheck.businessacc@proton.me with the words “security report” in the subject. Tell us what you found and how to reproduce it. We will acknowledge within five working days. Please do not access, modify or delete data belonging to anyone else while testing, and please give us a reasonable chance to fix the issue before disclosing it.

See also the Privacy Policy and the list of subprocessors.