VET Mobile App Security (VetApi)

PANTHEON Vet Mobile is an ideal solution for veterinary practices as it integrates both an ERP system for managing your business processes (accounting, payroll, HR management, travel orders, stock etc.) and a module specifically designed for vet practices working with either small or large animals. The application is accessing a cloud database directly where all the data is immediately saved without possibility of data loss. Offline work (limited) is also supported with synchronization after reaching internet connection (WI-FI, mobile data).

Below is an overview of the key security elements that protect your data and access to the system.

1. Infrastructure and Environment

The VET mobile application is hosted on Telekom's infrastructure, which applies an additional layer of security through their security settings and strict policies.
In the production environment, all database connection credentials are removed from the source code, preventing misuse in case of unauthorized access to application files.

2. Network and Connectivity

All network communication in the VetApi app is handled via the HTTPS protocol, implemented using the Retrofit library.
This ensures end-to-end encryption of all data exchanged between the application and the server, protecting against eavesdropping and man-in-the-middle attacks.

3. Access and Authentication

VetApi uses strong multi-layer authentication mechanisms:

• Passwords are never stored in plain text. Instead, they are hashed using the SHA-256 algorithm with salting, creating irreversible hash values.

• All access to sensitive API endpoints is protected with the [Authorize] attribute, requiring a valid token. Unauthorized access attempts return a 401 Unauthorized response.

• Less critical endpoints (e.g., for diagnostics) are explicitly marked with [AllowAnonymous] for controlled public access.

4. Data Management

• Database connection credentials are encrypted using RSA asymmetric encryption, ensuring secure storage of access data.

• In case of connection loss, critical data is securely saved locally using the OfflineUtil module, preventing transaction loss.

• Before executing fiscal operations, the app performs a validation check for passwords, certificates, and other key data, ensuring document integrity and legal compliance.

5. Updates and Maintenance

VetApi is built using a modular architecture with ViewModel and LiveData, which separates business logic from the UI layer.
This structure supports safe updates and easier maintenance without exposing core security mechanisms.

6. Regulatory Compliance

• The system verifies the validity of fiscal certificates and only allows fiscalization when all legal conditions are met.

• Transparent permission handling (e.g., BLUETOOTH_CONNECT, READ_PHONE_STATE) with active validation ensures compliance with Android platform security guidelines.

7. Audit and Access Logging

• Any unauthorized access attempt within the application is rejected and logged, enabling reliable detection of abuse.

• Errors and exceptions are presented via structured reporting mechanisms, enhancing system oversight and issue detection.

8. Business Continuity and Data Recovery

• The app includes offline fallback mechanisms, allowing secure local data storage and synchronization once connectivity is restored.

• Data remains protected during outages or temporary connection issues, significantly reducing the risk of data loss.