Security & data protection

NarcCount is built to store inventory and recordkeeping information — drug DINs, quantities, dates, and optional invoice or prescription reference numbers — not patient names or patient health information. See our Privacy Policy.

The primary database is hosted in Canada (Supabase, ca-central-1). Some processing by our service providers — application hosting and delivery, payments, email, the support line, error monitoring, and optional AI features — may occur outside Canada; we limit this to what is needed to run the Service and bind those providers by contract.

All traffic to NarcCount is encrypted in transit with TLS, and your data is encrypted at rest by our hosting providers.

Every record belongs to a pharmacy, and access is enforced at the database level with PostgreSQL row-level security — a user can only ever read or write data for a pharmacy they are a member of.

• Role-based access: owners and admins manage the team and billing; staff have day-to-day access only.
• Each count records who counted it and who signed it off, and a finalised count is locked.
• A tamper-evident, append-only audit trail records who did what, and when.

Sign-in is handled by Supabase Auth. You control who is invited to your pharmacy, and you can remove access at any time.

We use Supabase (database, auth, storage — Canadian region), Vercel (hosting), Stripe (payments), Resend (email), Twilio and ElevenLabs (our support line), and OpenRouter (AI features). We send these providers only what is needed to operate the Service, and we do not send patient identifiers to AI. Our Privacy Policy has the full list.

If a security incident affecting your information poses a real risk of significant harm, we will notify you and, where required, the appropriate authorities without undue delay, as described in our Privacy Policy.

Found a security issue? Email support@narccount.ca. Please give us a reasonable chance to investigate and fix an issue before disclosing it publicly.