Can A Mobile Application use TrueVault to store JSON data without a "middleman" server?

Question

I have been reading the documentation at https://docs.truevault.com/ but I am a little confused. I read this on the true vault site:

If you plan on using any of the server-side libraries, please ensure any hosting environment you use is HIPAA compliant.

I took this to mean that TrueValut could support a standalone (client side only) mobile application architecture. Where the TrueVault API was the only server side interaction.

However my understanding of the documentation is that:

1. An API_KEY is required to register a new user.
2. Any API_KEY provides full access to all data vaults and JSON documents stored in TrueVault.

If both of these assumptions are correct that would mean it would be impossible to register new users directly from the client side app, forcing me to use a costly and resource intensive HIPPA compliment web server. The only way to get around this would be top hard code the API_KEY into the app, an obvious no go if that API_KEY can access all of my TrueVault data.

For my use case I have the following requirements for TrueVault for me to be able to consider using it (I would imagine these requirements are the same for anyone looking to develop a client side only healthcare application):

1. A user can sign up via the API directly from my client side app without requiring any sensitive keys or root auth data.
2. A user can authenticate using only the data they provided to sign up (username/email/password). My app is multi platform I cant ask them to remember their API keys to log in.
3. A user can Read/Write/Update/Delete data linked to their profile. They can not access any data from another user using their credentials.

Is TrueVault able to deliver these three basic requirements?

If the answer to this is "No" I would recommend you update this text on your website as there are not going to me any viable HIPPA compliment applications that can be supported by TrueVault without an independent server side interface.

Answer 1

I'm currently using AWS Lambda as a solution. Lambda is HIPPA compliant, more info here. Lambda is also a low cost solution.

Here is an example of the code I'm running on Lambda using Node.js.

var request = require('request-promise');
var _ = require('lodash');

function encodeBase64(str) {
  return (new Buffer(str)).toString('base64');
}

var baseUrl = 'https://api.truevault.com/v1/';
var headers = {
  'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8'
};
var req = request.defaults({
  baseUrl: baseUrl,
  headers: _.extend({
    Authorization: 'Basic  ' + encodeBase64('your api key:')
  }, headers),
  transform: function(body) {
    return JSON.parse(body);
  }
});

exports.handler = function(event, context) {
  req.post('users', {
    form: {
      username: event.email,
      password: event.password,
      attributes: encodeBase64(JSON.stringify({
        name: event.name
      }))
    }
  }).then(function() {
    context.succeed({user: user});
  }).catch(context.fail);
}

Answer 2

In general, you are correct - if you include zero server-side processing between user and TrueVault, then the API keys will be public. At least, I don't know of any way to avoid this.

That being said, it is incorrect to jump to "any API_KEY provides full access to all data vaults and JSON documents stored in TrueVault." - that's not the case if setup properly.

TrueVault API keys are able to be narrowed in scope quite a lot. Limiting a key to only Write permission on {Vault#1}, a second key to only Read permission on {Vault#2}, a third key to allow uploading Blogs in {Vault#1&#3}, quite a few variations, a forth for deleting information from {Vault#2}, and on as needed. You can also limit permissions specifically to content "owned" by the API key (e.g. user-specific keys) Full documentation here.

There are also limited scope keys (set expiry time, usage count, limit to any of the prior permission scopes). Docs here.

TrueVault also offers user logins separate from API keys which may be better suited if your user are using login credentials. Docs here.

I'm still rather figuring out TrueVault myself (at time of writing at least) so be sure to research and review more for your needs. I'm still torn if the limited scoping is "good enough" for my needs - I'm leaning towards using AWS Lambda (or similar) to be a HIPAA compliant middle man, if only to better hide my access token generation and hide that my data is going to TrueVault and add some "serverless-server-side" data validation of sorts.