The safest data is data we never store.
Your medical records are the most sensitive thing you own. We built VA Claim Commander so that, in the self-serve tools, we never have to hold them in the first place — and the founder who designed it does security for a living.
We don't keep your records
In the self-serve tools, your uploaded records are parsed in your browser and used to build your documents in your session. They are not persisted on our servers afterward. “Start Over” clears everything. The safest data is data we never store.
Encrypted in transit and at rest
All traffic is encrypted in transit (TLS), and the limited data our infrastructure does hold is encrypted at rest by our hosting and database providers. That's the floor, not the headline — the headline is that we hold as little as possible.
No PII in our logs
We never write your personal or medical information to logs, error reports, or analytics. Diagnostics are scrubbed by design, so sensitive details can't leak through the back door.
Data minimization to the AI
When AI drafts a document, we send it only the specific fields that document requires — never your entire file. Our AI provider (Anthropic) does not train on this data and may retain requests up to 30 days for abuse monitoring — full detail in our Privacy Policy.
When a real provider reviews your records
If you choose Commander Health for a provider-signed nexus letter, a licensed clinician has to actually review your records — so in that workflow your documents are handled server-side. That handling is governed by signed Business Associate Agreements (HIPAA) with our infrastructure providers, the same covered-entity-grade standard a clinic operates under.
In other words: the free self-serve tools are built to never hold your records; the one path that genuinely needs to — a clinician signing a medical opinion — is wrapped in the strongest agreements available. You always know which one you're in.
Who designed this
A security architect who is also a 100% P&T veteran
Most companies this size, if they're lucky, have a security person somewhere on staff. At VA Claim Commander, security is the founder. Dr. Mike Roberts is a 100% Permanent & Total Air Force veteran who does information security for a living — a PhD in Information Systems Security who has spent his civilian career in the field, and has even taught the material as a cybersecurity instructor (Security+ and CISSP).
Founder credentials
- • CISSP — Certified Information Systems Security Professional
- • CISSP-ISSAP — Information Systems Security Architecture Professional
- • CISM — Certified Information Security Manager
- • CCIE-Security — Cisco Certified Internetwork Expert
That's why the architecture leads with not collecting your data rather than just promising to guard it. When the person who designs the system has spent a career on how data gets breached, the first instinct is to make sure there's nothing there to breach.
VA Claim Commander is a verified Veteran-Owned Business, certified by the Texas Veterans Commission (VEP-099193).
“Encrypted at rest” isn't the same as safe
“Encrypted at rest” is worth reading carefully: it means your records are being kept — your whole file, indefinitely — with the stored pile encrypted. Encryption helps, but a stored hoard of veterans' medical records is still a target, and it's yours held on someone else's server.
We'd rather not hold it at all. By default we process what your claim needs and let it go — nothing to mine, nothing to sell, nothing to leak, nothing to hold hostage if you decide to leave. That's a structural choice, not a marketing line.
What we store — and what we never store
We store (the minimum)
- • Your email and name — so you have an account
- • Your preferences and monthly usage counts (no medical info)
- • Commander Health & Advocates only: client documents, under signed HIPAA BAAs
We never store
- • Raw uploaded medical records in the self-serve tools — parsed in your browser, then discarded
- • Your data for AI training — never, on any plan
- • Personal or medical info in logs, errors, or analytics
- • Card numbers — payments run through Stripe; we never see them
Standards & reporting
In transit
TLS encryption on every request; HTTPS enforced.
At rest
Provider-managed encryption on the limited data we hold.
Practices
OWASP-aligned, PII-scrubbed logging, least-privilege access.
Found a security issue? We take every report seriously — email support@vaclaimcommander.com and we'll respond promptly.
Built to be trusted with the hard stuff
Start your claim with tools designed by someone who protects sensitive data for a living — free, and built from your real evidence.
Not affiliated with or endorsed by the Department of Veterans Affairs. VA Claim Commander is not a VSO, law firm, or accredited representative.