Security overview
How the Wellward Cash Price API protects your keys and the data it handles. Report a security issue to hello@wellwardhealth.com (see below) — please don't test against other customers' accounts or data.
No PHI, by design
The API is a source of provider prices. It is built not to receive information about the people you serve:
- Requests take a service, a location and options. A request body containing a field that names a person (name, email, phone, date of birth, member id, and similar) is refused with 400, at any depth.
- In a request body, a field the endpoint does not document is refused rather than silently dropped, so identity cannot arrive under an unexpected name either. (Unknown query parameters on GET requests are ignored.)
- A few fields take free text or your own data — a price request's
query,location.textandmetadata, and notes on contributions and updates. We cannot inspect what you write there, so keep anything about a person out of them. - Our request log stores no API key, IP address, user agent or query string. Locations are rounded to about 7 miles.
Keys
- Keys are 32 random bytes. We store only a SHA-256 hash of each key combined with a server-side secret; the key itself is shown to you once and cannot be recovered.
- Test and live keys are separate. Test keys cannot read live data or create work.
- Rotate without downtime: create a new key, switch, then revoke the old one. Revocation is immediate.
- Send keys from your servers only — never embed them in a browser, a mobile app or a public repository.
Transport
The API is served only over HTTPS (TLS 1.2 and 1.3). Responses that depend on your key are marked private so no shared cache can hold them.
Webhooks
Every delivery is signed with HMAC-SHA256 over a timestamp and the raw body, with a per-endpoint secret. Verify the signature and reject stale timestamps — see Webhooks.
Infrastructure and data
- Hosted on AWS in US regions. Managed PostgreSQL with encryption at rest and point-in-time recovery.
- Card details are handled entirely by Stripe; Wellward never sees or stores a card number.
- Backups: continuous, automated backups with point-in-time recovery.
- Retention: API request logs are kept 90 days and then summarized. When you close your account (dashboard → Team), every key stops working at once, and we delete the account's data within 30 days — members and their sign-ins, webhooks, support tickets and usage details — keeping only the billing records we are required to retain. Backups age out within 30 days. You delete cached Data as the API Terms require (§10).
Access
- Your dashboard uses email sign-in links (single-use, 15-minute expiry) and roles: admin, developer, billing. Only admins can create live keys, manage the team, or accept terms.
- Wellward staff access to API accounts requires an administrator role, and account changes — key creation and revocation, terms acceptance, role and spending-cap changes, and invoice and suspension events — are recorded in an audit log.
Incidents
Service incidents are posted on the status page. If a security incident affects your account or data, we notify your organization's administrators by email without undue delay after confirming it. Include the X-Request-Id when reporting an issue.
Reporting a vulnerability
Report vulnerabilities to hello@wellwardhealth.com. We acknowledge reports within three business days. We will not pursue good-faith researchers who report promptly, avoid accessing other customers' data, and give us reasonable time to fix the issue.