Security & Data Protection

Where your data lives

Client records are stored in India, in the Mumbai region (AWS ap-south-1), and the application runs from the same region. Data is encrypted in transit with TLS and at rest. Backups are encrypted and retained on a fixed schedule.

If your regulator or professional body requires client data to stay in a particular country, MealStack cannot meet that today. We would rather you know before you subscribe than after.

Who else processes it

Every sub-processor is named in our Privacy Policy — the database, hosting, file storage, email, caching, payments and AI providers, with what each one handles. The one worth reading closely is OpenAI: it powers Sage and the AI features, so content sent to those features is processed in the United States. AI is opt-in per practice and can be left off entirely.

Who controls the data

The practice is the controller of its own client records. MealStack is a processor acting on the practice's instructions. You can export your data at any time, and you can ask us to delete it. We extend access, correction, erasure, export and withdrawal of consent to everyone, wherever they are, rather than only where a law compels it.

What we do not have yet

We are a small company and this list is honest rather than flattering.

• No HIPAA Business Associate Agreement. If you are a covered entity — most commonly a US practice billing insurance electronically — MealStack is not a suitable place for protected health information. Practices working cash-pay are generally not covered entities, but that judgement is yours.
• No SOC 2 or ISO 27001 attestation. The controls described above are real, but no external auditor has certified them.
• No EU or UK representative. We cannot yet serve practices established in the EEA, the UK or Switzerland, and signup marks those countries as coming soon rather than quietly accepting them.

These are cost and time, not principle, and they are on the roadmap in that order. If one of them is what stands between us, tell us — knowing which door is shut for which practice is how we decide what to open first.

Reporting a problem

If you believe you have found a security issue, email [email protected]. Please give us a reasonable window to fix it before disclosing it publicly. For privacy questions or to exercise your rights, write to [email protected].