Dom & Tom Inc. is a digital product development agency based in New York, Chicago, and Los Angeles, specializing in mobile and web products with a portfolio of over 90 mobile and 300 web applications. A case study on Dignity Health revealed the creation of a NICU app for engaging new parents, featuring encryption and strong legal collaboration to ensure compliance and efficiency. The company emphasizes devsecops practices and infosec training to maintain data security throughout the development process.

1. DOM & TOM INC DOMANDTOM.COM NEW YORK: 646 741 5049 / CHICAGO: 773 377 5585
DOMANDTOM.COM NYC 646.741.5049 / CHI 773.377.5585

2. Do Good. Be Good.
That’s what we do.

3. WHO AM I?
Dom Tancredi
» Full-Stack Developer of 18+ years.
» CTO School Member (since 2014).
» Fun Fact: Theatre + Computer Science degrees.
» Certified ScrumMaster + Product Owner.
3
Dom & Tom
» Launched 90+ mobile // 300+ web products.
» 60 team members.
» New York, Chicago & Los Angeles.
» Digital product development agency.
» Enterprise + startup-friendly.

4. D&T BREAKDOWN

5. CASE STUDY:
Dignity Health Hospital Group

6. OPPORTUNITY
6
Goals
» Bring brand to the 21st Century on mobile and tablet.
» Grow relationships with patients.
» Stay within InfoSec and legal policies of hospital.

7. SOLUTION
7
The Product
» St. Rose's NICU app reaches out to new parents on mobile and tablet.
» Cross-platform marketing approach to communicate with parents.
» Portfolio of products:
» iPhone, iPad, Android phone and tablet.
» 2 hospital NICU centers.

8. SOLUTION
8
Mobile
» iOS and Android phone and tablet applications for Dignity Health
Group’s neonatal intensive-care unit (NICU).
» The hospital group was not granted access to retrieving cloud patient
data.
» The applications track and graph measurements and feeding data.
Information is provided to doctors for tracking child progress after
parents bring their infants home. All data is stored locally.

9. SOLUTION
9
Mobile
» Strong collaboration with Dignity Health’s legal team to approve all
content.
» Architecture for white labeling and sharing resources among
applications made building and deploying much more efficient.
» 6 applications were built.
» iOS: utilized multi-target codebase and had a core library for specific
packages and extended to custom visuals.
» Android: utilized core library (package-first) philosophy to integrate into
custom product versions.

10. SOLUTION
10
Mobile
» Encryption of data locally in key-value pairs.
» Decrypted data when visualized and viewed by users.
» iOS data stored in key-value pairs which, since iOS6, has encryption built
in.
» Recommend RNCryptor (iOS) and AESCrypt (Android) for higher-order
encryption (AES-256) if customizing encryption with datastores
methodologies.
» Datastore (iOS): CoreData, SQlite, Plist (iOS), Keychain as potential
vectors for lifting datasets out of system.
» Datastore (Android): Database, Internal // External Storage, SQLite
Shared Pref (similar to Keychain).

11. Personally identifiable information (PII) is any data that could
potentially identify a specific individual. Any information that can
be used to distinguish one person from another and can be used
for de-anonymizing anonymous data can be considered PII.
SOLUTION
11
Server-Side
» AWS utilization was planned for in the product roadmap.
» AWS technologies roadmapped.

12. SOLUTION // PROCESS
» Planning: Project planning added milestones and estimations for
user experience, design and sprint feature-set per platform for legal
review.
» Legal: Created early relationship in process with legal teams on
feature-set, design and implementation changes.
» “MLR:” Medical Legal Review where legal can make adjustments and
changes to any part of an application.
» Planning: Planned per release platform for MLR.
12

13. DEVSECOPS @ D&T
FIP-range restricted
access to servers
Key-restricted servers to
DevOps + Tech leads
Tech
AWS + Digital Oceans; Ansible;
Docker + Rancher for dev, staging,
production instances.
13
Client-side encryption
of data
Encryption via SSL
communication to servers
MDM or testing
Mobile device management or testing
with Hockey or TestFlight.
Ask yourself: How might someone access the data, the business
logic or spoof the experience?

14. DEVSECOPS @ D&T
» InfoSec Policy defined at D&T.
» InfoSec Training with technical leads.
» Working to shape and share DevSecOps policies
with startup clients (being aware of OWASP Top
10, social engineerings, etc.).
14

15. Questions?

16. THANKS!
Dom Tancredi (CEO & CTO)
dom@domandtom.com
DOM & TOM // domandtom.com
LinkedIn