1. Data Encryption

• In transit: All communications between the JOY app and Firebase are encrypted using TLS 1.2 or higher. No data travels unencrypted.
• At rest: Firebase Storage encrypts all files (photos, voice recordings) using AES-256. Firestore database documents are encrypted at rest by Google Cloud.
• Authentication tokens: Firebase Authentication uses industry-standard JWT tokens with short expiry times. Refresh tokens are stored securely using platform-native secure storage on iOS and Android.

2. Access Control

• Firebase Security Rules: Firestore and Firebase Storage are protected by security rules that restrict every read and write operation to authenticated users with the correct role (senior or caregiver) and the correct family account association. No unauthenticated requests are permitted.
• Least privilege: Application code requests only the permissions necessary for each specific feature. Caregivers cannot read another caregiver's family data. Seniors cannot access other seniors' data.
• Cloud Functions: Server-side Cloud Functions (Anthropic API calls, notifications) use Firebase service accounts with restricted IAM roles. API keys (including the Anthropic API key) are stored as Firebase Secrets, not in source code.
• Source code: Firebase configuration files (GoogleService-Info.plist, google-services.json) are gitignored and never committed to version control repositories.

3. Infrastructure Security

JOY runs on Google Firebase and Google Cloud Platform, which maintain:

• SOC 1, SOC 2, and SOC 3 compliance
• ISO 27001 certification
• Physical security at data center facilities
• Automated threat detection and DDoS protection
• Regular third-party security audits

Google's infrastructure security documentation is available at cloud.google.com/security.

4. Authentication Security

• Passwords are hashed by Firebase Authentication — we never store plaintext passwords
• Sign In with Apple provides a privacy relay email, minimizing email exposure
• Google Sign-In uses OAuth 2.0 with scoped access (email and profile only)
• We recommend users enable two-factor authentication on their Google or Apple account for additional protection

5. Vulnerability Disclosure

We operate a responsible disclosure policy. If you discover a security vulnerability in JOY, please report it privately — do not publicly disclose it until we have had a reasonable opportunity to investigate and address it.

To report a vulnerability:

• Email: joy@joyhealthtechnologies.com
• Subject: Security Vulnerability Report
• Include: description of the vulnerability, steps to reproduce, potential impact, and your contact information

We will acknowledge receipt within 48 hours and provide a status update within 7 days. We do not currently offer a bug bounty program, but we are grateful to researchers who help keep JOY secure and will publicly acknowledge responsible disclosures (with permission) after patching.

6. Incident Response

In the event of a security incident affecting user data, we will:

• Contain the incident and assess the scope as quickly as possible
• Notify affected users by email within 72 hours of confirming a breach, including what data was affected and what steps we are taking
• Work with relevant authorities if required by law
• Implement remediation measures to prevent recurrence

7. What You Can Do

• Use a strong, unique password for your JOY account (if using email/password auth)
• Enable two-factor authentication on your Apple ID or Google account
• Do not share your JOY login credentials with anyone outside your family
• Log out of shared devices after using JOY
• Keep your iOS or Android operating system updated
• Contact us immediately if you suspect unauthorized account access