Mobile security
Biometric authentication, session timeout, signing out remote sessions, and what to do if a phone is lost.
How the app keeps PHI safe
Vantrexia mobile is built to HIPAA-grade standards. The short version:
- All traffic is TLS-encrypted. Nothing leaves your device in the clear
- Credentials and tokens are stored in the iOS Keychain with the strictest access class (your phone must be unlocked)
- Patient data shown on screen is cached encrypted and wiped if you sign out
- App previews in the iOS task switcher are automatically blurred to protect anything visible
- The app does not store reading data on the device past 24 hours
- Sessions expire after a period of inactivity and require re-authentication
Biometric authentication
Face ID or Touch ID is the recommended way to unlock the app between sessions. It is faster than typing a password and meets HIPAA's "unique user authentication" requirement on a personal device.
Enable or disable: Profile → Security → Biometric unlock.
When biometric unlock is on:
- Opening the app prompts for Face ID / Touch ID
- A failed biometric falls back to your account password
- After 5 failed attempts, the app forces a full sign-in
Biometric unlock secures the app on your phone. It does not authenticate to Vantrexia's servers. The first time you set up a new device, you must sign in with your password and (if enabled) two-factor authentication.
Session timeout
The app automatically signs you out after a period of inactivity. The default is 15 minutes for clinical accounts. You can shorten it under Profile → Security → Auto-lock timer.
Auto-lock applies even when biometric unlock is on. Biometrics let you re-enter quickly, but the lock still happens.
| Action | Result |
|---|---|
| You background the app | Re-prompt on return after the timer elapses |
| Phone locks | App locks immediately on next open |
| You leave the app open and put the phone down | Locked after the timer elapses |
Active sessions
You can see every device currently signed in to your Vantrexia account and revoke any of them.
The signed-out device gets booted to the login screen on its next network call, usually within seconds.
What to do if your phone is lost or stolen
Treat a lost phone as a security incident. Move quickly.
Even if the lost phone has Face ID enabled, no one without your face or your Vantrexia password can read patient data on it. The data cache is encrypted at rest and unreachable without a successful unlock. Still, treat it as a reportable incident.
Two-factor authentication
If your practice enforces 2FA (recommended), you'll be prompted for a 6-digit code on every fresh sign-in. The codes come from your authenticator app (Google Authenticator, 1Password, Authy, etc.), not from SMS. SMS 2FA is not supported because it's vulnerable to SIM-swap attacks.
If you set up a new phone, you must move your authenticator to it before wiping the old one. If you're already locked out, an Owner or Admin in your tenant can reset your 2FA from Settings → Team in the staff portal.
Reporting a suspected breach
If you think your account has been accessed by someone else (for example, you see sign-in activity from an unfamiliar location) do all of the following:
- Sign out every active session from the staff portal.
- Change your password.
- Report the incident to your practice's Privacy Officer.
- Email security@vantrexia.com with the time, location, and any details.
We respond to verified breach reports within one business hour during US business hours.