Security

In Transit: All communication between your device and our servers is encrypted using TLS 1.3. We enforce HTTPS across all endpoints and reject insecure connections. Certificate pinning is used on mobile clients to prevent man-in-the-middle attacks.

At Rest: All data stored in our databases is encrypted using AES-256 encryption. Database backups are also encrypted, and encryption keys are managed through a dedicated key management service with rotation policies.

File Storage: Uploaded files (baby photos, milestone photos) are stored in encrypted object storage with per-object access controls and signed URLs for temporary access.

Babilly uses secure token-based authentication. Authentication tokens are short-lived and refreshed automatically. We never store passwords in plain text — all credentials are hashed using industry-standard algorithms with salt.

For users who sign in with Google, we use OAuth 2.0 and never receive or store your Google password. We only receive your email address and basic profile information as authorized by you.

Access to baby data is strictly enforced through multiple layers: authentication at the application layer, authorization rules at the API layer, and Row-Level Security at the database layer. A caregiver can only see the specific data categories you explicitly grant, and parents can revoke access at any time with changes taking effect immediately.

Every entity in our database is protected by Row-Level Security policies. This means that authorization is enforced at the database level, not just the application level. Even if an API vulnerability were exploited, the database itself would reject unauthorized access.

RLS policies ensure that:

• Parents can only read, update, and delete data for babies they own or are authorized caregivers for
• Caregivers can only access data categories explicitly permitted by the parent
• Daycare staff can only access babies linked to their daycare account
• Audit logs are restricted to admin-level access and cannot be modified by regular users
• Soft-deleted records are hidden from all standard queries

The baby owner's user ID is denormalized onto every log record, enabling parents to view all data created for their baby by caregivers and daycare centers — even if they didn't create the record themselves.

While Babilly is designed for personal use and may not always be classified as a "covered entity" under HIPAA, we voluntarily implement HIPAA-aligned safeguards for all health-related data:

• Minimum necessary access: Caregivers and daycare staff only see the data categories explicitly permitted by the parent
• Audit logging: All data access and modifications for daycare features are logged with timestamps, staff email, and IP context
• Breach notification: We maintain breach detection and notification procedures. In the event of a confirmed breach, affected parents are notified within 60 days
• Business Associate Agreements: Daycare providers using the Service agree to confidentiality obligations and HIPAA compliance
• Access revocation: Parents can revoke daycare or caregiver access immediately and permanently from the app

Babilly is designed to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

• Data subject rights: We support access, rectification, erasure, portability, and objection requests
• Consent management: Caregiver sharing and notifications are based on explicit, withdrawable consent
• Data minimization: We only collect data necessary to provide the Service
• Right to be forgotten: Account deletion processes personal data within 30 days, with audit trails retained for compliance
• No data sales: We do not sell personal data to any third party, ever
• International transfers: We use Standard Contractual Clauses for cross-border data transfers

When linking a daycare provider, the daycare must provide a valid 6-character parent invitation code. This code is generated by the parent and shared out-of-band, ensuring only authorized daycares can link to a baby.

All daycare staff activity is logged with timestamps and staff email for accountability. Parents can view a full access audit trail at any time and revoke daycare access immediately from the app. Revocation is permanent and takes effect instantly.

Daycare accounts require a signed HIPAA agreement before activation. Staff emails are whitelisted per daycare account, and only whitelisted staff can create logs. All logs created by daycare staff are automatically tagged with the source "daycare" and the staff member's email.

Babilly is hosted on enterprise-grade cloud infrastructure with the following safeguards:

• Automatic failover and multi-zone redundancy for 99.9% uptime
• Regular security patching and dependency vulnerability scanning
• Web Application Firewall (WAF) to detect and block malicious traffic
• Rate limiting and DDoS protection on all public endpoints
• Intrusion detection systems monitoring for anomalous access patterns
• Regular automated and manual security reviews
• Anti-iframe security headers to prevent clickjacking and spoofing attacks

Backend functions run in isolated, serverless execution environments with no persistent state, reducing the attack surface.

We only collect the data necessary to provide the Service. We do not serve ads, and we do not build advertising profiles. Your baby's health data is never sold or shared with marketers, data brokers, or analytics companies.

Usage analytics are aggregated and anonymized — they cannot be traced back to an individual user or baby. We use analytics solely to improve the Service and detect abuse.

We maintain a documented incident response plan with the following phases:

• Detection: Automated monitoring and alerting for security anomalies
• Containment: Immediate isolation of affected systems and revocation of compromised credentials
• Investigation: Forensic analysis to determine scope and root cause
• Notification: Affected users notified within 60 days of confirmed breach, per HIPAA-aligned procedures
• Remediation: Patches deployed, access revoked, and measures taken to prevent recurrence

Security incidents are documented in a tamper-resistant audit log and reviewed by our security team.

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue in Babilly, please report it to security@babily.app with the following information:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots

We take all reports seriously and aim to respond within 48 hours. We request that you do not publicly disclose the vulnerability until we have had time to investigate and remediate it.

We do not pursue legal action against researchers who report vulnerabilities in good faith and in accordance with responsible disclosure principles.

We use the following categories of sub-processors to operate the Service. All sub-processors are bound by Data Processing Agreements and are reviewed for security and compliance:

• Cloud hosting & database: Enterprise-grade cloud infrastructure provider
• Email delivery: Transactional email service for notifications and shared reports
• Authentication: OAuth providers (Google) for secure sign-in
• File storage: Encrypted object storage for photos and attachments

We will provide at least 30 days' notice before adding or replacing a sub-processor that processes personal data. To receive sub-processor change notifications, subscribe at privacy@babily.app.