Skip to main content

Security is the architecture, not a checklist.

We administer protected health information, so storage, transport, access, and audit were built to the 2026 HIPAA Security Rule from the first commit. Retrofitting these into a platform that was not designed for them leaves gaps, and gaps surface during an audit rather than before one. Here is what that means in practice, including the part that is not finished.

  • 2026 HIPAA Security Rule
    Built to it, not retrofitted
  • AES-256 encryption
    At rest and in transit
  • Immutable audit logs
    7-year retention
  • SOC 2 Type II
    In progress, and we say so
  • Clearinghouse-ready EDI
    Claims in, remittances out

The controls

What stands behind every claim we touch.

Encryption everywhere

AES-256-GCM encryption at rest with KMS-managed keys, plus field-level envelope encryption on the most sensitive PHI columns: SSNs, dates of birth, banking details. TLS 1.2+ for every connection in transit.

Immutable audit logging

Every access to protected health information is logged to append-only, write-once storage and retained for seven years. Audit logging is a boot-time requirement, the platform refuses to serve traffic if the audit pipeline is down.

AWS infrastructure

The platform runs on AWS with a multi-AZ database, automated failover, encrypted backups, and infrastructure managed as code so every security setting is reviewable and reproducible.

Access control

Role-based access with least privilege, multi-factor authentication, short-lived sessions, and scheduled access reviews. Per-tenant isolation is enforced at the data layer. One employer's data is never visible to another.

Monitoring & detection

Control-plane activity is captured in tamper-evident audit trails with automated alerting on anomalous patterns: failed-login bursts, after-hours administrative activity, and mass-export attempts page a human.

Secure development

Static and dynamic security analysis run in CI, dependencies are scanned continuously, and changes ship through review gates. Security regressions are blocked before merge, not patched after deploy.

No hedging

Compliance posture, stated plainly.

  • HIPAA. The platform is built to the 2026 HIPAA Security Rule, under which every safeguard is mandatory. We sign Business Associate Agreements with every plan we serve and with every subprocessor that could touch regulated data, the full list is on our subprocessors page.
  • SOC 2. A SOC 2 Type II examination is in progress. We say “in progress” because that is the truth. We will publish the report when it is complete, and we share our security documentation under NDA during evaluation in the meantime.
  • Data handling. No sale of data, ever. No PHI in application logs. Member data is exportable in standard formats, and plan data leaves with the plan if the relationship ends.

Reporting a vulnerability

We welcome good-faith security research. Report suspected vulnerabilities to [email protected] with “Security report” in the subject line. Include enough detail to reproduce the issue; we acknowledge reports within two business days and will not pursue action against researchers acting in good faith.

Verify it, do not take it on faith

Put us through your security review.

We share the full security documentation under NDA during evaluation, including the findings we are still working through.

Request a Proposal See how it works