Where the money goes, where the data sits, and what we refuse to claim.
VetApprove touches three sensitive things: a signature, a card payment and a pet owner's contact details. Here is how each one is handled, in plain terms, including the parts that are not flattering.
How the proof actually works.
When a pet owner approves a plan, we record what was shown, what was accepted, by whom, from where and when. That record is the audit trail. It is written once, at signature, and never edited afterwards.
The sealed record, and the PDF made from it
At signature we freeze the accepted content as a record: the lines, the totals, the signer's name and the time. The estimate can no longer be edited afterwards. A change means a new estimate, sent and signed again. The PDF is rendered on demand from that record, today in your browser when you open the estimate, so the file you download is always a rendering of the record and never a separate truth. The canonical content is attached to the PDF so anyone can check it.
The hash
The hash is a SHA-256 of the canonical JSON of the accepted content, not of the PDF file. It is computed at signature and stored with the signature record. Recompute it from the canonical content and compare: identical hash, identical content. Change a single character, a price or a line and the hash is completely different. It is a tamper check, not an encryption method, and it does not prove who signed. The audit trail does that part.
- Timestamp
- The moment of signature in UTC and in the clinic's local time.
- IP address
- The public IP the signature was sent from.
- Device
- Browser and operating system reported by the device (user agent).
- Open receipt
- Every time the link was opened before signing, with dates and times.
- Accepted content
- The exact line items, labels, quantities, prices, taxes, total and deposit that were on screen at signature. Not a later revision.
- Signature
- The drawn signature image and the typed name of the signatory.
- Identity of the document
- Estimate reference, clinic name and the plan title shown above the signature.
What we hold and how it is kept.
Two categories: your clinic's account data, and the estimates and client details you put in. They are treated differently.
Encrypted in transit
Every page, every API call and the connection to the database run over TLS. The database is Supabase Postgres, encrypted at rest by our provider. The sealed PDF is not stored as a public file anywhere: it is rendered from the record for a signed-in user, or attached to the email we send the pet owner.
The pieces we run on
The app runs on Cloudflare Workers. The database is Supabase Postgres, reached through Cloudflare Hyperdrive over TLS. Email goes out through Resend, from hello@vetapprove.com. Card payments are handled by Stripe. That is the entire list of companies that touch your data, and it is the same list you will find in our privacy notice.
One region, in the United States
There is a single region during early access: Virginia, United States (Supabase us-east-1). You do not choose it and we do not pretend you can. Cloudflare serves the pages from the edge; the records themselves live in that one database. If we ever add a region or move this one, you are told before it happens, not after.
Per-clinic isolation
Every record carries the clinic it belongs to, and every query is scoped to the signed-in clinic. One clinic can never read another's estimates, clients or templates. Inside your clinic, the people who share your login see everything in it. We can reach the database as operators, which is how we fix things and restore data; we do not read your estimates for any other reason.
Kept while you are a customer, deleted on request
Records stay for as long as your account is active. Ask us and we delete your clinic's data. Export first: the CSV of totals and lines, and every signed PDF, come out as files you keep. If you want us to keep signed documents as proof after you leave, that is your call and we tell you exactly what stays and for how long.
What we do not do with it
We do not sell data. We do not email your clients for our own purposes. We do not train models on your estimates, your prices or your clients. Aggregate, anonymised usage counts (how many estimates were sent, how fast they were signed) are the only thing we look at across clinics.
The money never passes through us.
Stripe Connect Standard, direct charges
Your clinic connects its own Stripe account. Deposits are created as direct charges on that account: your clinic is the merchant of record, the funds land in your Stripe balance and are paid out on your own schedule. VetApprove is not a payment institution and does not hold client funds. We take nothing on the deposit, Stripe's fees apply: not a percentage of it, not a fixed fee on it.
No card data touches our servers
The card form is rendered by Stripe in its own hosted fields. Card number, expiry and CVC go straight from the pet owner's browser to Stripe. Our servers see a payment identifier, an amount, a status and the last four digits. Never a full card number. That is also why there is nothing for anyone to steal from us on that front.
Refunds and disputes are yours
You refund from your Stripe dashboard, under your own terms. If a pet owner disputes a charge, the chargeback is between them, their bank and your clinic, under Stripe's rules. We hand you the audit trail and the sealed PDF as evidence; we cannot decide the outcome and we do not sit in the middle of it.
What VetApprove provides is a simple electronic signature backed by an audit trail: the drawing, the typed name, the timestamp, the IP, the device, the open receipt and the hash of what was signed.
In the United States, this is the kind of signature described by the ESIGN Act, which gives electronic signatures and records the same legal effect as paper in most commercial contexts.
Early access is open to clinics in the United States only, so the ESIGN Act is the frame we design against. That is the protection a simple signature gets. And the limit of it.
We do not provide an advanced or a qualified electronic signature. There is no qualified trust service provider behind it, no certificate issued to the signatory, and no identity document check. If your case needs that level, you need a different tool, and we will say so rather than sell you ours.
What we do not claim.
No HIPAA
Veterinary records are not protected health information: HIPAA covers humans, not pets. Any vendor selling you "HIPAA-compliant veterinary software" is selling a label that does not apply to the animal data in question. Human data we do hold (your staff accounts, your billing details) is handled under ordinary privacy law.
No compliance guarantee
We have no SOC 2 report, no ISO 27001 certificate and no PCI attestation of our own. Card data is handled by Stripe, which is PCI certified; that is Stripe's certification, not ours, and we will not dress it up as ours. If a certificate is a requirement for you today, we are not your vendor today.
No legal advice
We are not lawyers. What a deposit commits your clients to, how your refund terms should read, and whether a signed estimate is enforceable in your jurisdiction are questions for your own counsel. We give you the record; the agreement is yours.
No guaranteed acceptance rates
Nobody can promise you that more plans will be accepted. The calculator on our pricing page runs on numbers you set yourself, and it is labelled as an assumption because that is what it is.
If you have found a vulnerability, email us with what you found and how to reproduce it. We reply within one business day, we fix what is real, and we credit you publicly if you want to be credited. We do not send lawyers at people acting in good faith.
- Please do not test against a real clinic's estimates or a real pet owner's data. Ask us for a test account.
- Please do not run automated scanners or load tests against production.
- Please give us a reasonable window to fix an issue before writing it up publicly.
Support
One address for everything: bugs, questions, billing, cancellation, deletion requests and security reports. A founder answers within one business day, Monday to Friday. There is no phone line yet.
hello@vetapprove.comTen clinics. Then we close the door for a while.
We are onboarding the first cohort by hand, one clinic at a time, to get the templates right for your species and procedures. Tell us where you are and we'll send the payment link and a 15-minute slot.