Mission Claim Security & Trust
Protecting sensitive Veteran information
Veterans claims can contain identity, military-service, financial, disability, and health information. Mission Claim is designed around least-necessary access, secure transport, private document handling, tenant separation, and auditable workflows.
HTTPS and transport protection
Mission Claim uses HTTPS for the public application. HTTP requests redirect to HTTPS, and the production domain sends a Strict-Transport-Security header. Browser security policy also blocks mixed-content upgrades and limits executable content sources.
Server-side secrets
VA credentials, API keys, signing integration credentials, email credentials, and similar secrets are kept in server-side environment or secret storage and are not intentionally placed in browser code or public records.
Identity, role, and tenant access
Authenticated areas enforce user identity. Professional access is further limited by role, organization assignment, accreditation-related workflow checks, and matter-level authorization. Organization data is kept logically separated by organization identifiers and authorization rules.
Private documents
Sensitive files use private storage references and short-lived signed access where supported. Mission Claim's secure document viewer authorizes access before creating the temporary file URL and records document-access audit events.
Duplicate and replay safeguards
Sensitive communications use idempotency keys where supported. VA submission workflows maintain submission records and status so a previously submitted or in-progress transaction can be blocked from accidental duplicate submission.
Logging and audit trail
Security-sensitive workflows record operational and audit events, including document access, invitations, representation workflows, signature activity, communications, and VA submission status where implemented.
Unauthorized and duplicate VA requests
Mission Claim requires authenticated professional access for protected VA workflows. Organization ownership is checked before accessing a submission record. Sandbox write workflows explicitly reject real-Veteran use unless the sandbox test flag is present. Submission records, status checks, file hashes, and duplicate/in-progress guards are used to reduce accidental repeated requests.
Incident response
When Mission Claim receives a credible report of unauthorized access, disclosure, loss, or misuse, the response process is to triage the report, contain affected access, revoke credentials or sessions when appropriate, preserve relevant security records, determine scope, remediate the cause, and provide notices required by applicable law or contractual obligations.
Vulnerability and patch management
Mission Claim reviews application dependencies and security findings as part of release work. High and critical known dependency vulnerabilities are treated as release blockers unless a documented mitigation applies. Moderate findings are evaluated for exploitability and compatibility impact, then patched or mitigated through the normal update cycle. Security-sensitive changes are tested against the application's regression checks before release.
Report a security issue
Email support@notify.missionclaim.com with the affected URL or feature and steps to reproduce. Do not email Social Security numbers, VA file numbers, passwords, access tokens, medical records, or private keys. A machine-readable security contact is published at /.well-known/security.txt.