Security & data handling

What this application does with data, how it is reached, and how to report a problem. Last reviewed 2026-08-28.

What the application is

QUIC Egram Analyzer is a research instrument for electrophysiology studies. It captures unipolar intracardiac electrogram waveforms from a cardiac mapping system's display, extracts the waveform, and records the landmark annotations a reviewer confirms. It is used by clinical investigators as a measurement and record-keeping tool.

What data it holds

• Case records. A date, a case identifier chosen by the operator, a recording site, a physician name, and the captured waveform images with their annotations and measurements.
• The case identifier is entered by the operator and is intended to be a study-local, de-identified label. The application never asks for a name, a medical record number, a date of birth, or any other direct identifier, and has no field to put one in.
• Credentials. A username, a role, a recording site, and a password hash. Nothing else.

Where the data goes

• It stays on the machine the application runs on. Studies are written to a directory on that server and are read back from it. There is no cloud storage, no external database, and no backup service in the application.
• Nothing is sent to a third party. The application makes no outbound requests of any kind while serving a page. There is no analytics, no error-reporting service, no advertising, no tracking, no fonts, scripts, or stylesheets loaded from anyone else's server. Every asset the browser fetches comes from this origin, and the Content-Security-Policy header enforces that rather than merely promising it.
• One cookie. A signed session cookie, marked HttpOnly and SameSite=Lax (and Secure when served over TLS), holding a username and a session token. There are no other cookies and no local storage of case data in the browser.

Who can reach what

• This page and the home page are the only pages reachable without signing in. Every other route is refused to an anonymous request. That is enforced by a table classifying every endpoint, checked ahead of every request: an endpoint nobody has classified is closed, not open.
• Two account tiers. An administrator manages credentials and reaches every function. An investigator captures, calibrates and annotates, and cannot open other people's prior studies, use the archiver, or reach the development tools.
• Study access is decided from the stored record, never from anything the browser asks for.
• There is no default account and no default password. A new installation has no credentials at all until an administrator is created at the console.
• Passwords are stored as scrypt hashes. No plaintext password is stored, logged, or returned by any endpoint.
• Failed sign-ins buy delay, not a lockout, with an exponential backoff keyed on both the username and the source address — a lockout on a username is a denial of service handed to anyone who knows one.

Transport and browser hardening

• HTTPS only in any deployment reachable off the host, with HTTP Strict Transport Security sent on every TLS response.
• Content-Security-Policy with script-src 'self' — no inline script anywhere in the application — plus frame-ancestors 'none', object-src 'none' and base-uri 'none'.
• X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that denies every browser capability except the camera and display capture the waveform capture needs, and same-origin isolation headers.
• Cache-Control: no-store on every page that is not a static asset, so a signed-in page is not left in the browser cache of a shared workstation, and X-Robots-Tag: noindex on everything but this page and the home page.

Reporting a vulnerability

Reports are welcome and will not be met with legal action for good-faith research: testing that avoids degrading service, avoids accessing or retaining anyone else's data, and gives us a reasonable chance to fix the issue before it is published.

Contact: security@quicscore.org. Machine-readable details are at /.well-known/security.txt (RFC 9116). We aim to acknowledge a report within three business days.

What this is not

This application is not a certified medical device, is not FDA cleared, and is not offered as a diagnostic tool. It is research software, and the scoring algorithm is patent pending (OHSU docket 3528-1). No claim of HIPAA, SOC 2, or HITRUST certification is made or implied. The controls described above are engineering measures in this application; a deployment's overall compliance posture also depends on the host, the network, and the institution's own agreements, which are outside this software.