1. Current safeguards
The hosted website uses platform access controls. Contact and demo requests are received through a validated same-origin endpoint and stored in the hosted database; no public inquiry-reading endpoint is exposed. The Google key is a protected server runtime secret. Lookup calls use fixed provider endpoints, bounded inputs and timeouts, trusted-host Maps redirects, no-store responses and a soft in-memory request limit.
Public Google profile data and derived drafts are session-only. Manual workspaces remain in local browser storage. Optional media is temporary. Client-side stored state can be inspected and modified by the person using that browser.
2. A defined data boundary
Do not enter patient health records, passwords or payment card data into the workspace. No real account tokens, cloning, calls, bookings, posts or ad spending are created by the connection walkthroughs. Listing selection is not a clinic access grant.
3. Production development
Account-connected delivery will need authenticated customer tenancy, per-operation authorization, durable quotas and jobs, encrypted token handling, revocation, audit records and incident procedures. These planned controls are not represented as deployed features.
No ISO, SOC 2, HIPAA or other certification is claimed on this website.
4. Report a security issue
Email security@wexnex.com with the affected page, steps to reproduce and a proportionate description of the impact. Do not access other people’s data, disrupt the service or include real credentials or patient records. A public bounty or guaranteed response time is not offered.