Information Security Program

Effective September 16, 2026

This page is the written information security program referenced in our Privacy Policy's Security section. It describes the safeguards actually built into MathPath, not a generic template — every control listed here is checked against the running code and infrastructure, not aspirational.

Scope

Covers the MathPath web application, its database, and the server it runs on. It does not cover third-party services we rely on (Stripe for payment processing, Twilio SendGrid for email) — each maintains its own security program, linked below.

Data in transit

The site is served over HTTPS only, with a certificate that renews automatically. Session cookies carry the Secure flag whenever the connection is HTTPS, so a session cookie is never sent over plain HTTP.

Passwords

Passwords are never stored in plain text. Each is hashed with PHP's password hashing API using its current default algorithm, and the stored hash is automatically upgraded the next time someone signs in if that default has since changed to something stronger — so an account created years ago is not permanently stuck on a weaker algorithm.

Session and request security

Session cookies are HttpOnly (not readable by page JavaScript), SameSite=Lax, and Secure over HTTPS, with strict session-ID handling enabled so a session ID supplied by an attacker rather than generated by the server is rejected.
CSRF protection: every state-changing request must carry a per-session token generated with a cryptographic random source; a request without a valid token is rejected before it touches the database.
Every API endpoint scopes its query to the signed-in session — a user id supplied in a request body is never trusted on its own. A caregiver's Care Dashboard query, for example, always joins through the invite-acceptance table filtered to that caregiver's own session, not a patient id taken from the request.

Database

No string-built SQL. Every query uses parameterized prepared statements, including values like row limits that are easy to overlook — checked by a standing code audit, not left to habit.
Least-privilege database account. The application connects as a database user permitted to read and write application tables only, not an administrative account.
Automated encrypted backups, off the server itself, on a tiered daily/weekly/monthly schedule — see the Data Retention Policy for how long a given snapshot survives.

Secrets and configuration

Database credentials, the Stripe secret key, and the email provider's API key live in one configuration file outside the public web folder, additionally blocked from being served directly even if that ever changed, and readable only by the server process, not the world. None of it is committed alongside the application's own source history in a way that would expose it publicly.

Payments

MathPath's own servers never receive or store a card number. Checkout happens on Stripe's own hosted payment page; only a customer reference and subscription status come back to us. Stripe is a PCI DSS Level 1 certified payment processor — see Stripe's security documentation.

Webhook and email-provider integrity

Both external services that can trigger account changes verify a cryptographic signature before anything is trusted: a Stripe webhook is verified against Stripe's signing secret before it can activate or cancel a subscription, and our email provider's delivery-failure webhook is verified against its own signing key, with old or replayed requests rejected on a short time window. An unsigned or incorrectly-signed request from either is dropped before it reaches any code that writes to the database.

Server hardening

The server enforces mandatory access control (SELinux, in enforcing mode) on top of normal file permissions, restricting what the web server process can read or execute even if application code were compromised. Security-relevant HTTP response headers (X-Content-Type-Options, X-Frame-Options, a restrictive Referrer-Policy) are set on every response, and API responses are marked non-cacheable so a shared cache or browser history never retains one.

What this program does not claim

MathPath is not independently audited or certified (no SOC 2, ISO 27001, or similar) as of this writing. This page describes the controls that exist today, honestly, rather than implying a certification we do not hold.

This is a plain-language description of current practice, not a legally binding certification. It is written to satisfy the FTC's amended COPPA Rule requirement for a written information security program, disclosed alongside the Privacy Policy, and is reviewed whenever the application's security-relevant architecture changes, not on a fixed calendar.

Reporting a security concern

If you believe you've found a security issue in MathPath, please email support@mathpathrehab.com with details rather than testing it against real accounts.