Built as a HIPAA Business Associate — not retrofitted for it.

AES-256-GCM envelope encryption via AWS KMS; TLS 1.2/1.3

• Encrypted PHI columns across each schema: 46 Dashboard, 47 Edu
• Unique data encryption key per operation, zeroed from memory after use
• Separate customer-managed KMS keys — the Dashboard and Edu platforms each have their own application-layer PHI key, plus a dedicated disk-layer key for database storage and an isolated CloudTrail audit-log key
• TLS 1.2/1.3 enforced at ALB and CloudFront; 1.3 negotiated when client supports it
• S3 bucket policies reject any non-encrypted upload

MFA required (Clerk + JWT); 15-min idle timeout; quarterly reviews

• Mandatory MFA — Clerk instance-level enforcement plus JWT isMfa claim check on every request
• Server-side session timeout at 15 minutes idle; multi-instance safe
• Quarterly access reviews for all privileged access
• Org-scoped isolation enforced on every query at the application layer; PostgreSQL Row-Level Security policies defined on 26 tables as forward-compatible defense-in-depth
• Fail-closed MFA enforcement: missing isMfa claim = rejected request

70+ CloudWatch alarms; CloudTrail Object Lock 7-year; daily KMS-signed manifests

• 70+ CloudWatch alarms covering auth failures, error spikes, dead-letter queue growth, Inspector critical findings
• CloudTrail Object Lock COMPLIANCE mode — logs cannot be deleted for 7 years
• Daily KMS-signed audit log integrity manifests verifiable without trusting the platform
• GuardDuty threat detection; Security Hub against CIS AWS Foundations
• OWASP ZAP DAST scans every Sunday against deployed platform

Bedrock-only inference; per-call audit log; NIST AI RMF crosswalk

• All Claude API calls in production route through AWS Bedrock — never the Anthropic Direct API
• Every Bedrock inference generates an audit row with call ID, pass type, token counts, and outcome
• Bedrock invocation logging to an Object-Locked S3 bucket — every model call captured at the AWS layer, model I/O not persisted
• Bedrock invocation logging with text_data_delivery_enabled = false — model I/O not persisted to S3
• Adversarial regression suite: 15 prompt-injection payloads with a live-pipeline execution mode grading delimiter breach and downstream containment; CI validates the payload corpus on every change

All subprocessors tracked with attestation refresh dates

• One subprocessor with PHI access: AWS (full BAA signed)
• Clerk, Stripe, CourtListener handle practitioner identifiers only — no clinical content
• Annual attestation refresh cycle for all third-party integrations
• Full subprocessor list published at /subprocessors
• New vendor onboarding requires security review before integration

Documented IR plan v1.3; §164.404 60-day timer; BA-to-CE notification register

• Written incident response plan covering detection, containment, eradication, and recovery
• HIPAA Breach Notification Rule §164.404: 60-day notification timer tracked per incident
• Business Associate-to-Covered Entity notification register maintained for each customer
• Tabletop exercise conducted April 2026; semi-annual cadence per the IR plan
• Post-incident review process with RCA and corrective action tracking

Encryption that travels with the data, not just the disk

Every PHI field is encrypted at the application layer before it touches the database. We use AES-256-GCM with envelope encryption: a unique data encryption key per operation, zeroed from memory after use, protected by a customer-managed master key in AWS KMS that rotates every 365 days and never leaves AWS hardware.

• 46 encrypted PHI columns on the Dashboard schema and 47 on the Edu platform
• Separate customer-managed KMS keys — Dashboard and Edu each with their own application-layer PHI key, plus a dedicated disk-layer key and an isolated CloudTrail key
• S3 bucket policies reject any non-encrypted upload

Walls between organizations

If you work at a multi-evaluator practice, you are not sharing tables with strangers. Every query in the application is scoped to your organization — every read filters by your org ID and every write requires it — and we verify that isolation with automated cross-organization tests and periodic full-codebase security reviews. PostgreSQL Row-Level Security policies are defined on the same tables as a forward-compatible second layer on our hardening roadmap.

• Application-layer org-scoping on every query, verified by automated cross-org isolation tests
• Row-Level Security policies defined on 26 main-database tables as forward-compatible defense-in-depth
• Audited every time a new table is added to the schema

Who gets in, how, and for how long

Multi-factor authentication is mandatory — not an optional Security tab. The application checks the MFA claim on every request and fails closed if it cannot prove you passed. Sessions time out after 15 minutes of server-enforced inactivity. Every access is captured in an append-only audit log.

• Mandatory MFA with fail-closed enforcement on every request
• 15-minute server-side session timeout, multi-instance safe
• Append-only audit log retained for 7 years (2,557 days)

What is kept out of our error reports

When something breaks, engineers need diagnostic information — but they do not need patient names. Request bodies are never logged; what does get reported runs through a scrubber that redacts any field ending in _encrypted and scans free text for SSNs, dates of birth, addresses, MRNs, ICD-10 and DSM-5 codes, and psychological test score patterns before it leaves the platform.

• Request bodies are never logged — the scrubber operates on URLs and error metadata
• Pattern-matched scrubbing for SSNs, DOBs, MRNs, test scores, and PHI fields
• Session replay disabled platform-wide so screen contents are never captured