generated: '2026-08-15'
method: searched
source: https://www.modmed.com/security/
ownership_note: >-
  This is the PARENT company's program, and it is recorded for Klara deliberately.
  Klara is now wholly operated as a ModMed product: klara.com and www.klara.com 302
  every path to https://www.modmed.com/what-we-do/patient-engagement/, and Klara's own
  Terms of Service and Privacy Notice are already published on modmed.com
  (/klara-terms-of-service/, /klara-privacy/). There is no klara.com disclosure
  surface — probe-security-programs.py returned vdp=none for every Klara host, and the
  only 200 security.txt on a Klara host (status.klara.com) is Atlassian's Statuspage
  vendor document, not Klara's. The genuine route for reporting a Klara vulnerability
  is therefore ModMed's Coordinated Security Vulnerability Program.
program:
  name: Coordinated Security Vulnerability Program
  operator: Modernizing Medicine, Inc. (ModMed)
  url: https://www.modmed.com/security/
  http_status: 200
  type: coordinated-disclosure
  bug_bounty: false
  bounty_note: >-
    Published verbatim on the page: "ModMed does not offer compensation for reporting
    potential security vulnerabilities or other issues."
  audience: clients and security researchers
  customer_channel: >-
    ModMed customers are directed to contact ModMed Support and state that they have a
    security report for the VDP.
  required_submission_fields:
  - The affected systems or resource
  - Steps to reproduce the issue
  safe_harbor: partial
  safe_harbor_note: >-
    The page enumerates prohibited activity (decompiling/reverse-engineering
    proprietary software; viewing, modifying or destroying protected health
    information; unauthorized access to data; adversely impacting availability) rather
    than granting an explicit legal safe harbour.
security_txt:
  url: https://www.modmed.com/.well-known/security.txt
  http_status: 200
  served: true
  first_party_to_klara: false
  contact: mailto:security+txt@modmed.com
  policy: https://modmed.com/security/
  canonical: https://modmed.com/.well-known/security.txt
  preferred_languages: en
  expires: '2025-04-30T16:59:00.000Z'
  expired: true
  expired_note: >-
    RFC 9116 requires the Expires field to be in the future. This document expired on
    2025-04-30, more than a year before this probe, so it is served but stale.
  klara_host_note: >-
    No security.txt is served on any klara.com host. api.klara.com 404s,
    doctor.klara.com 403s, support.klara.com 401s, www.klara.com 302s, and
    status.klara.com's 200 is Atlassian's.
klara_host_probes:
- url: https://api.klara.com/.well-known/security.txt
  status: 404
- url: https://status.klara.com/.well-known/security.txt
  status: 200
  belongs_to: Atlassian (Statuspage vendor)
- url: https://support.klara.com/.well-known/security.txt
  status: 401
- url: https://www.klara.com/.well-known/security.txt
  status: 302
trust_center:
  url: null
  found: false
  note: >-
    No trust centre and no named third-party attestation (SOC 2, ISO 27001, HITRUST,
    FedRAMP, PCI DSS) is published for Klara or for ModMed. The only certification
    pages on modmed.com are ONC Health IT certifications for the EMA, gGastro and ASC
    EHR products — those belong to ModMed's EHR line, not to the Klara messaging
    product. See conformance/klara-conformance.yml.