> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tortus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & support

> Security model, browser support, and licensing for the TORTUS Embed SDK.

## Security considerations

The SDK is built for handling sensitive medical data. Keep these principles in mind:

* **Mint secrets server-side.** Always fetch client secrets and launch tokens from a secure backend you control. Never expose your client ID or secret to the frontend. See [Authentication](/authentication).
* **Secure message passing.** All communication between your app and the embedded experience uses secure message passing with origin validation.
* **Patient privacy.** A strict referrer policy and sandboxed iframe permissions protect patient data, and the embedded app stores encrypted data on the device rather than leaking PHI to the host.

<Warning>
  Treat launch tokens as short-lived secrets. They expire after 5 minutes and should be requested
  fresh from your backend for each session.
</Warning>

## Browser support

The SDK targets modern browsers and relies on:

* **ES2020+** language features.
* The **iframe `postMessage`** API.
* **`async`/`await`** syntax.

## Licence

© 2025 TORTUS AI. All rights reserved.

This library is provided under licence from TORTUS AI. Contact [TORTUS](mailto:support@tortus.ai) for licensing and usage terms.

## Need help?

<CardGroup cols={2}>
  <Card title="Contact support" icon="envelope" href="mailto:support@tortus.ai">
    Reach the TORTUS team for credentials, access, or integration help.
  </Card>

  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Revisit the fastest path to a working integration.
  </Card>
</CardGroup>