Legal
Security overview
This page summarizes Chronalio\u2019s security posture for legal, procurement, and compliance review. For the full, product-facing explanation see Security.
Encryption & emergency profiles
Chronalio treats emergency profiles — medical notes, ICE contacts, and sensitive identifiers — as high-risk data. Sensitive fields are encrypted with device-bound keys so that a database breach alone is not enough to read them.
Family circles are designed around private membership. Key material and sharing are scoped to people you explicitly invite, not a public social graph.
Privacy by design
Location and emergency audio/video are shared in the context of an incident or deliberate journey — not as continuous surveillance by default.
Chronalio Intelligence voice is push-to-talk only in current releases (no always-on wake phrase). We collect only what is needed to operate alerts, the companion, authenticate users, improve reliability, and provide support. See our Privacy Policy for categories of data, processors, and retention.
Chronalio Intelligence & LLM processing
Companion chat runs through Chronalio edge functions. Language-model API keys stay on the server — they are not embedded in the mobile binary.
Prompts and limited session context may be sent to contracted model processors solely to generate replies. Critical safety actions (HELP, journey stop/arrive, all clear, and similar) require in-app confirmation before they execute the same APIs as the UI buttons.
When the model service is rate-limited or unavailable, the app falls back to deterministic heuristics so core companion guidance can still operate.
Email, password & MFA
Chronalio uses email and password with mandatory email verification before app access. Strong passwords (12+ characters) are required; breached passwords are rejected when detectable.
Optional authenticator-app MFA (TOTP) with trusted devices is available in Security settings. Sessions can be revoked globally. Report suspicious login activity to support immediately.
Architecture overview
The Chronalio stack separates the consumer app, marketing site, and admin operations plane. Row-level security and membership helpers enforce who can see family and incident data.
Alert email/SMS and AI inference use server-side secrets. Support tickets from this website are handled through a dedicated API with rate limiting, attachment scanning bounds, and CORS restricted to Chronalio domains.