What is in place, and what is not yet.
A security page that only lists strengths is a security page nobody in a hospital review believes. This one separates the two.
In place today
Tenant isolation
Every tenant-scoped resource is enforced server-side and covered by automated tests, including the partner hierarchy, which grants portfolio totals and nothing at row level.
Multi-factor authentication
TOTP with single-use codes and hashed recovery codes. An organization can require it of everyone.
Encryption
TLS in transit. Stored claim payloads, contracts, attachments and sent packages are encrypted at rest with AES-256-GCM.
Role-based access
Explicit permission sets per role, with every permission stating in plain language what it allows.
Audit trail
Authentication, privileged actions, data export and every financial decision are recorded with the actor and the reason.
Identity minimization
The platform holds a deliberately minimal patient reference, and discloses only a last name and first initial outside it.
AI governance
Every AI touchpoint is logged with the model, prompt version and the records it could see. No model determines a dollar amount.
Secrets handling
Credentials are referenced by environment variable name, never stored in the database. The platform refuses raw-looking secrets outright.
Login protection
Per-account and per-address failure budgets enforced before any password work, so the endpoint cannot be used as a CPU lever.
Not yet — and we will not imply otherwise
No SOC 2 report
Readiness work is underway. We are not SOC 2 certified and will not describe ourselves that way until a report exists.
No HITRUST certification
There is no such thing as "HIPAA certified" either, and any vendor claiming it is telling you what they think you want to hear.
No independent penetration test yet
One is planned before large production deployments, and the report will be shareable under NDA when it exists.
No production EHR integrations
The architecture is EHR-agnostic and the connector framework exists. No Epic, Oracle Health or Cerner integration is live in production today.
Responsible disclosure
If you have found a vulnerability, tell us and we will work with you. We will not pursue legal action against good-faith research that avoids privacy violations, service degradation and data destruction.
What to expect
Acknowledgment within three business days, an assessment of severity, and updates until it is closed.