Security & Data Protection

Health records deserve health-grade protection

After Duty (formerly VA Claim Path) handles medical records, service records, and personal details. We protect them with the safeguards the HIPAA Security Rule is built on — encryption in transit and at rest, strict per-user access control, and data minimization.

Your health information is stored and analyzed on Google Cloud under a signed Business Associate Agreement (BAA), using only HIPAA-eligible services — in the United States, and never used to train public AI models.

HIPAA-eligible Google Cloud, under a signed BAA

After Duty runs entirely on Google Cloud services that are HIPAA-eligible — including Vertex AI, Cloud Run, Cloud SQL, and Cloud Storage — under a signed Business Associate Agreement (BAA) with Google. Your health information is handled to HIPAA’s standards, end to end.

How your data flows — and where it's protected

From your device to storage, every hop is encrypted and every request is scoped to you.

After Duty data-protection architecture Your devices connect over encrypted HTTPS/TLS to the application running on Google Cloud Run in the United States. Passwordless sign-in through Firebase establishes your identity, and a deny-by-default access-control layer ensures each request can only reach your own records. Data is stored encrypted at rest in a Cloud SQL database, in Cloud Storage for your documents, and in Secret Manager for application secrets. AI analysis by Anthropic Claude and Google Vertex Gemini reads your text to find conditions and evidence but does not train public models on your data. YOU Web app iPhone app Android app HTTPS / TLS APPLICATION Google Cloud Run · United States Passwordless sign-in Firebase · one-time codes, no passwords ACCESS CONTROL · deny by default Every request is checked against your identity — you can reach only your own records. Web session httpOnly cookie · token never exposed to the page least‑privilege STORED DATA ENCRYPTED AT REST · GOOGLE CLOUD Database (Cloud SQL) account · conditions · analysis Documents (Cloud Storage) the records you upload Secret Manager keys & secrets — never in code AI analysis · Anthropic Claude & Google Vertex Gemini Reads your text to find conditions and evidence. Providers process it under commercial terms and do not train their public models on your data. Runs on HIPAA-eligible Google Cloud services (US) under a signed Business Associate Agreement.

The safeguards, in plain terms

Nine protections that stand between your records and anyone who shouldn't see them.

Encrypted in transit

Every connection to After Duty uses HTTPS/TLS. Your records are never sent across the internet in the clear.

Encrypted at rest

Your documents and data are encrypted at rest on Google Cloud — both the database (Cloud SQL) and document storage (Cloud Storage).

You only ever see your own claim

Every request is checked against your identity, and the API denies by default. Changing an ID in a link can't reach another veteran's records.

Passwordless sign-in

You sign in with a one-time code sent to your phone or email. There's no password to leak, guess, or reuse.

Data minimization

We collect only what the tool needs to do its job, and internal access is limited to the minimum required to operate the service.

Your records aren't training data

Anthropic Claude and Google Vertex analyze your text under commercial terms — they do not train their public models on your data.

No ad tracking, no selling

Only strictly-necessary sign-in cookies. We don't use advertising cookies, and we never sell your information.

Delete everything, anytime

Deleting your account removes your documents, extracted data, and analysis, and cancels billing — a full wipe you control.

Built to be reviewable

Database queries are parameterized (no injection), there are no risky in-app data bridges, and the codebase is security-reviewed before each release with the findings tracked to closure.

Your data, your control

You decide what goes in, who sees it, and when it's gone.

1

You upload

Your records go straight into your private library over an encrypted connection — stored encrypted, visible only to you.

2

We analyze

Your text is read to pull out conditions, dates, and evidence. Everything is saved under your account only.

3

You review & correct

See exactly what was extracted, fix anything that's wrong, and export a copy of your data whenever you want.

4

You share — on your terms

Create a read-only link for your VSO or attorney. Share links are single-use, expiring, and revocable — nothing is shared unless you choose to.

5

You delete

One action erases your documents, data, and analysis and cancels any subscription. It's yours to remove, any time.

Where we stand on HIPAA

HIPAA is the U.S. standard for protecting health information, and we built After Duty to meet it. Your data is stored and processed on Google Cloud under a signed Business Associate Agreement (BAA), using only Google Cloud services that are HIPAA-eligible — including Vertex AI for analysis — with encryption in transit and at rest, strict access control, data minimization, and delete-on-demand.

One honest clarification: the government doesn’t issue a HIPAA “certification” — no one does, and any product that claims one is overstating it. What backs our claim instead is concrete — a real BAA with our cloud provider, HIPAA-eligible infrastructure, and safeguards you can inspect.

If you find a security issue, we want to hear about it — email [email protected] and we will respond. For the full picture of what we collect and your rights, see our Privacy Policy, or read how to delete your account or data at any time.

Your records, protected. Your claim, organized.

Free to start. Upgrade only when you need AI analysis. Share with your VSO any time.

Get started — free

Your data stays private and encrypted. Delete anything, any time.