Trust should be verifiable.Trust posture · last reviewed October 22, 2026

Credibility does not require perfection. It requires making limitations visible, distinguishing design from demonstrated capability, and stating what evidence would change the assessment.

This page exists because enterprise InfoSec teams shouldn’t have to chase a salesperson for two weeks to learn what state a control is actually in. Every fact below renders at the lowest state our record supports.

Compliance posture — today vs. roadmap

Compliance posture as of October 22, 2026: HIPAA safeguards applicable to SeniorCRE's role are IN PROGRESS and encryption is IN PLACE; SOC 2 is PLANNED, with no certification or report claimed; HITRUST is NOT YET AUDITED; ONC health IT certification is NOT PURSUED; no completed independent penetration-test report is claimed. AWS’s infrastructure assurance reports are not SeniorCRE reports. Review the Trust Center for control-specific status, evidence and limitations; no operator-production assurance is implied.

• SOC 2: SeniorCRE does not claim SOC 2 certification or its own SOC 2 report. Infrastructure inherits AWS SOC 2 controls today.
• HITRUST: No HITRUST assessment has been performed and none is represented here.
• ONC: ONC health IT certification is not being pursued. No certification has been granted and no certification program is underway.
• HIPAA: SeniorCRE implements the administrative, physical and technical safeguards applicable to its role under HIPAA and enters a Business Associate Agreement where required; status is as of the then-current date.
• GDPR / CCPA: Data privacy, right to erasure, consent management, standard contractual clauses.
• State Licensing: Meets state-specific senior care regulations.
• Penetration Testing: No completed independent penetration-test report claimed; continuous automated vulnerability scanning in place today.
• Incident Response: Detection → triage → containment → notification workflow with named roles; 24/7 on-call rotation introduced with the enterprise tier; formal runbook maturing toward pilot go-live.
• Tenant Isolation: Operator isolation is enforced at the database layer by PostgreSQL Row-Level Security under a non-owner connection role — fail-closed, with endpoint filtering as defense-in-depth.
• Per-facility scope: Per-facility isolation is enforced in the application layer today, hardening in progress, with extension to database Row-Level Security under active evaluation alongside automated cross-facility isolation tests.
• Evidence porting: The pgTAP isolation suite (operator-scoped RLS, cross-tenant access) was written against the prior schema and is being ported to Aurora + WorkOS in CI. Porting is remaining work and is not claimed as done.

Evidence package — what we send vendor risk

The Trust-by-Design package is the single shipment to your vendor-risk team. Documents marked Today / On request are available after an executed NDA. Documents marked In draft are finalized and ratified before pilot kickoff — we will not back-date a runbook to look ready.

Why under NDA? Pre-SOC 2 organizations do not publish architecture diagrams or control narratives openly. The NDA is a standard mutual NDA.

Service-level posture

Claims & Evidence Policy. No clinical outcome, accuracy, or dollar-value figures are published. Capability ≠ outcome. SLA figures on this page are design targets until validated by the first disaster-recovery drill and an executed enterprise SLA addendum.

Data residency & isolation

What we are honest about

• SeniorCRE does not claim SOC 2 certification or its own SOC 2 report; reports are published only when issued.
• No completed independent penetration-test report claimed.
• Native mobile app is not claimed in production; current mobile experience is a responsive PWA.
• No on-platform payments. SeniorCRE customer billing is invoiced through NetSuite — no PCI scope.
• Availability, recovery, backup, DR, penetration-testing and incident-response figures are engineering targets, not exercised results.
• Diligence material is produced on request under NDA. There is no evidence library, because a library would imply audits that have not occurred.

Mutual NDA — download & execute

Most procurement teams start here. The SeniorCRE mutual NDA is a standard two-year, Texas-governed instrument that covers the Trust-by-Design package (SIG Lite, CAIQ, architecture diagrams, control narrative, incident response plan, and pen-test scope). Reasonable redlines are returned promptly.

How to request the full package

Once the NDA is executed, reply to your sponsor at SeniorCRE or contact us at support@seniorcre.com with an introduction to your vendor-risk lead.