Security & compliance
This page is written for the person whose job is to say no. Everything on it is a specific mechanism rather than an adjective, because that is the only kind of claim that survives a review.
Security & compliance
A system holding protected health information should be able to describe its controls precisely enough that someone competent can check them. Here are ours.
What CareVault does not claim
There is no such thing as HIPAA-certified software. HIPAA has no certification scheme, and a vendor implying otherwise is making a representation the FTC treats as deceptive. CareVault signs a Business Associate Agreement, implements the safeguards described below, and gives you the evidence an auditor will ask for. Compliance remains a property of how your organisation operates — our job is to make it achievable and to prove what we did.
Every table carrying tenant data has a row-level security policy bound to a transaction-local session variable. The application connects as a role that cannot bypass it and owns none of the tables.
A query that opens without tenant context returns zero rows — the designed failure mode. CI fails the build if a table ships without a policy.
Each audit entry carries the hash of the one before it, so removing or altering a record breaks the chain from that point forward and the verifier says exactly where.
UPDATE and DELETE on the audit table are revoked at the database level, not merely avoided in code. Chain verification runs as a scheduled job and on demand.
National identifiers, contact details and other direct identifiers are encrypted per field with a tenant-derived key, alongside a keyed blind index so staff can still search on them.
AES-256-GCM with authenticated additional data binding the ciphertext to its tenant and column. A row copied to another tenant fails to decrypt rather than decrypting into the wrong chart.
Every server action and route handler proves the caller holds a live membership in the tenant before it touches data, then checks the specific permission.
CVE-2025-29927 showed that a crafted request can skip Next.js middleware entirely. Ours rewrites URLs and makes no security decision, so skipping it achieves nothing.
Opaque server-side sessions, not self-contained tokens. When a clinic terminates a member of staff, access ends within seconds rather than when a JWT happens to expire.
Only the SHA-256 of the session token is stored. A password change or forced sign-out invalidates every existing session at once.
You choose your region at sign-up: United States, European Union, India or the Gulf. Database, object storage and error telemetry all follow it.
Region is fixed at sign-up because changing it is a migration, not a setting. EU error traces routed to a US observability account is a residency breach that survives every other control.
BAA and DPA available on request — including Standard Contractual Clauses for transfers out of the EEA, and advance notice before a subprocessor changes.
Operational security
Design decisions are the easy half. These are the ones that have to keep being true every week.
Argon2id password hashing, TOTP multi-factor that a workspace can make mandatory for staff, step-up authentication before high-risk actions, and an IP allowlist per tenant. Sessions are server-side and opaque, with a 12-hour absolute cap and a configurable idle window.
Every PHI read and write is logged with the patient it concerned, which is what makes the disclosure report producible on request rather than reconstructed. The report is available to the workspace administrator without asking us.
Bulk exports, break-glass access, out-of-hours record access and access to a colleague's own chart are surfaced to administrators. The controls that catch insider misuse are not the same controls that stop an intruder.
Point-in-time recovery on the database with a 35-day window, encrypted backups held in the tenant's own region, and restore drills run on a schedule rather than assumed to work.
Erasure requests collide with statutory medical-record retention of roughly 6 to 30 years depending on jurisdiction and patient age. Records move through a documented disposition — retain, pseudonymise, crypto-shred, archive — and we will tell you which statutory floor applies to you.
Dependencies scanned continuously, a documented disclosure address, and a commitment to tell affected tenants about a confirmed breach of their data within 72 hours — the GDPR clock, applied everywhere rather than only where it is required.
Data residency
Region is chosen at sign-up and fixed there, because moving it afterwards is a migration project rather than a settings change. Database, document storage and error telemetry all follow it.
| Region | Database | Documents | Telemetry |
|---|---|---|---|
| United States | us-east-1 | S3, US | US |
| European Union French tenants are placed on an HDS-certified hosting region. | eu-central-1 | S3, Frankfurt | EU |
| India DPDP Act 2023 applies. ABDM integration exchanges FHIR R4 bundles. | ap-south-1 | S3, Mumbai | India |
| Gulf Cooperation Council Malaffi, NABIDH, Riayati and NPHIES integration is tied to facility licensing, not only to product configuration. | me-central-1 | S3, UAE | Middle East |
Routing one region’s error traces to another region’s observability account is a residency breach that survives every other control, so the pinning is explicit rather than incidental.
Subprocessors
Published because GDPR Art. 28(2) entitles you to know, and because the half of this list with direct PHI access is the half worth reading.
Last updated . Customers on a signed DPA receive advance notice before a subprocessor is added, and may object.
| Subprocessor | Purpose | PHI access | Locations | Contracts |
|---|---|---|---|---|
| Amazon Web Services | Application hosting, PostgreSQL, object storage, key management Only HIPAA-eligible services are permitted in PHI accounts, enforced by a service control policy rather than by convention. | Direct | us-east-1, eu-central-1, ap-south-1, me-central-1 |
|
| Anthropic | AI triage summaries, ambient scribe drafting, coding suggestions Every AI feature is off by default per tenant. Enabling one is a deliberate act taken after the addendum is in place, not a product default. | Direct | us |
|
| Stripe | Card payments and CareVault subscription billing Line-item descriptions sent to the gateway are generic. Diagnosis and service names never leave the platform in payment metadata. | Incidental | us, eu |
|
| Razorpay | Card and UPI payments for tenants billing in INR | Incidental | in |
|
| Paystack | Card payments for tenants billing in NGN, GHS, ZAR and KES | Incidental | ng, za |
|
| Twilio | SMS appointment reminders and tokenised patient links Appointment time plus provider and clinic name is PHI in combination. Message bodies carry no diagnosis, service name or result value — the link exists so detail stays behind authentication. | Incidental | us, eu |
|
| Sentry | Error tracking The most commonly missed gap in health tech. Runs with PII capture disabled, request bodies scrubbed before transmission, and EU tenants pinned to the EU-hosted organisation. | Incidental | eu, us |
|
Contracts
Available before you commit to anything, not after you have signed an order form.
Business Associate Agreement. Signed with any customer handling protected health information under HIPAA, on Professional and above. It names the permitted uses, the breach notification timeline, the subcontractor flow-down, and what happens to PHI at termination.
Data Processing Agreement. Available on every plan including the free tier, with Standard Contractual Clauses for transfers out of the EEA and the UK addendum. The subprocessor register above is incorporated by reference, and you get advance notice with a right to object before it changes.
Security pack. Architecture description, threat model summary, penetration test summary, backup and recovery procedures, incident response plan, and a completed CAIQ-style questionnaire. Sent under NDA on request.
One thing we will not put in writing
That CareVault is “HIPAA certified” or “HIPAA compliant software”. Neither phrase describes anything real — HIPAA has no certification scheme and compliance attaches to a covered entity’s programme rather than to a product. A vendor that puts it on a sales page is either mistaken or is telling you what you want to hear, and both are useful things to know about a vendor before you hand them patient records.
FHIR R4 interoperability
Coded at capture with the terminologies the receiving system expects, exposed over a standards-compliant API, and exportable in bulk without anyone writing a query.
Patient, Practitioner, Organization, Location, Encounter, Condition, AllergyIntolerance, MedicationRequest, Observation, DiagnosticReport, ServiceRequest, Immunization, Coverage and DocumentReference.
RESTful search with the standard parameters, `$everything` for a full patient record, and transaction bundles for writes. Growth and Enterprise plans include write access; Professional is read-only.
EHR-launch and standalone-launch flows so a third-party clinical app can open in context with scoped, time-limited access — and appear in the audit trail as itself, not as the clinician.
Asynchronous group-level export in NDJSON for population health, research extracts and payer reporting, without anyone writing a database query.
LOINC on laboratory tests, SNOMED CT on problems, RxNorm on medications, ICD-10 and CPT on billing. Coded once at capture, so the export is not a text-matching exercise.
ABDM in India, Malaffi and NABIDH in the UAE, NPHIES in Saudi Arabia. These are licensing-bound integrations, so scope is confirmed per facility rather than assumed.
FHIR conformance is published as a machine-readable CapabilityStatement at the API root, so you can check exactly which resources and search parameters are supported rather than taking this page’s word for it. Regional programme integrations depend on facility licensing and are scoped per site.
We will answer a questionnaire, join a call with your IT team, or hand over the whole pack under NDA. What we will not do is ask you to take any of this on trust.
Responses from an engineer, usually the same day.