SeniorCRE
§ Security & Compliance Architecture Brief
The single status table lives at /trust-center. Compliance posture as of October 22, 2026: HIPAA safeguards are in progress; a BAA template does not establish an executed agreement. Encryption is implemented, independent test pending; SOC 2 is PLANNED, with no certification or report claimed; HITRUST is NOT YET AUDITED; ONC health IT certification is NOT PURSUED; no completed independent penetration-test report is claimed.
Ask where the boundary is enforced, not whether it exists.
Operator isolation is enforced at the database layer and fails closed. PHI has no public retrieval path — buckets are private and objects are served through short-lived signed URLs minted per authenticated request. A counsel-reviewed BAA is available and its execution is a pilot-readiness gate. Assurance status is stated without target dates, and what has not been done is named on this page.
HIPAA-safeguarded controls; no SOC 2 certification or report claimed.
§ I · Tenant isolation model
Five boundaries, and the one that has to hold
Operator/tenant isolation is designed for enforcement at the database layer; the current-stack isolation test suite is incomplete. The design uses PostgreSQL Row-Level Security and a non-owner connection role. Endpoint-level filtering is defense-in-depth, not independent proof of isolation.
Identity — Who the caller is
Enforced todayFederated identity with SSO (SAML 2.0) for enterprise tenants and mandatory MFA on administrative roles. Session timeout and concurrent-session limits enforced server-side.
Failure mode: No verified identity means no tenant context, and no tenant context means no rows.
API / transport — What the caller may ask for
Enforced todayTyped API layer applies tenant and role gates on every request before a query is composed. This is defense-in-depth, not the primary boundary.
Failure mode: A missed gate degrades to the database boundary rather than exposing data.
Database — operator/tenant — Which operator owns the row
Enforced todayPostgreSQL Row-Level Security policies evaluated under a non-owner connection role, with tenant identity set from the authenticated session on every request.
Failure mode: Fail-closed. Without tenant context the policies return zero rows; they do not return another operator’s rows.
Database — facility — Which community inside an operator
Enforced in application layer todayPer-facility scoping is enforced in the application layer today. Extension to database Row-Level Security is under active evaluation, with automated cross-facility isolation tests in progress.
Failure mode: Facility scope is a code-enforced boundary today, so it is disclosed as application-layer rather than represented as database-enforced.
Privileged functions — What runs with elevated rights
Enforced todayElevated database routines are explicitly enumerated, set an explicit search path, and are not granted to anonymous or general authenticated roles. Role membership is stored in a dedicated role table and never on a profile record.
Failure mode: A role claim carried in client storage cannot grant privilege; role checks resolve server-side.
The Aurora migration preserves the Row-Level Security policies the platform already paid for. The session-context wrapper sets tenant identity so the existing RLS policies fire on every request under WorkOS auth — it does not replace policy enforcement, and queries fail closed without it.
§ II · PHI storage and signed-URL handling
No PHI object has a permanent URL
Bucket posture
Every bucket that can hold PHI — resident photos, staff photos, family communications, resident documents, therapy photos — is private. There is no public read path to a PHI object.
A public object URL is permanent and un-revocable once it leaves your network. Private-by-default removes that class of exposure rather than managing it.
Retrieval
PHI objects are served through short-lived signed URLs minted per authenticated request. Application records store the object path, never a resolved URL.
Storing a path rather than a URL means access is re-authorized on every read, and revoking a user revokes their access to the object.
Signed-URL lifetime
Signed URLs expire well inside their maximum validity window, and client-side caching is deliberately set below the expiry so an expired link is re-minted rather than surfaced to a clinician as a broken asset.
Expiry is only a control if the cache respects it. Aligning the two prevents both stale links and long-lived links.
Non-PHI assets
Marketing and brand assets — logos, listing images, avatars, press material — are served from separate public buckets. The classification decision is made at the bucket, not per file.
Mixing classifications in one bucket is how PHI ends up behind a public URL. Separation makes the mistake structurally hard.
Residency
PHI is processed and stored in United States regions, with encrypted backups to a second US region. No PHI is processed or stored outside the United States.
Residency is a contract term in most operator and REIT agreements, not a preference.
Encryption
Encryption in transit and at rest across application, database, object storage, and backups, with managed key material and rotation.
Encryption is table stakes; the reviewable part is whether it covers backups too. It does.
§ III · BAA readiness
What we sign, and what we will not route until we can
Operator BAA
Available on requestA counsel-reviewed Business Associate Agreement is available and is executed with every covered-entity customer. Execution is a pilot-readiness gate: PHI does not move before signature.
Downstream sub-processor BAAs
In progressSub-processors that can touch PHI are enumerated with role, data category, and region, and are required to be under BAA before they are placed in a PHI path. Coverage is tracked per processor rather than asserted globally.
LLM / model-provider BAA
PlannedNo model-provider BAA is in place. PHI routing requires appropriate executed agreements and validated safeguards. This requirement is not evidence of tested transmission enforcement; until acceptance, model use must remain scoped to permitted non-PHI inputs.
Data Processing Agreement
Available on requestGDPR / CCPA-aligned DPA with standard contractual clauses for any cross-border transfer of non-PHI data.
Audit logging (supports future BAA obligations)
Enforced todayThis row is the audit-logging control, not the agreements themselves: business associate agreements are In progress. Append-only audit logging with UTC timestamps and full user and session context supports the accounting-of-disclosures and forensic obligations a BAA creates.
Data portability and exit
PlannedOperator export and termination rights are contract commitments. Full governed-record export and deletion require implementation and validation; no independent export/deletion evidence is established by this description.
§ IV · Assurance posture
The answers a reviewer usually has to extract
Are you SOC 2 attested?
No. SeniorCRE does not claim SOC 2 certification or its own SOC 2 report. We do not publish a target date. Each report is published when it is issued. AWS infrastructure is covered by AWS’s own SOC assurance reports; those are not SeniorCRE reports.
Has an independent penetration test been completed?
No. No independent third-party penetration test has been completed and no pen-test report has been issued. An independent engagement is planned; the report will be published when issued. Continuous automated vulnerability scanning is in place today.
Is HIPAA compliance claimed?
We operate HIPAA-safeguarded controls and are BAA-ready. HIPAA has no certification to claim, so the reviewable artifact is the control narrative mapping HIPAA Security Rule requirements to platform behavior — available under NDA.
Is any of this running in an operator production environment?
No. There is no completed operator-production deployment and no integration running in operator production. Controls described here are enforced in shipped code and built, not yet validated. That distinction is stated everywhere it applies.
Is the isolation test suite complete?
No. The database isolation test suite was written against the prior schema and is being ported into CI on the current stack. Porting is remaining work and is not claimed as done. The RLS policies themselves are enforced today; the automated proof of them is being rebuilt.
What would you not sign?
We will not sign a representation that we are SOC 2 attested, that a pen-test report exists, that an operator is in production, or that clinical outcomes are guaranteed. If a questionnaire requires one of those, the answer is no rather than a qualified yes.
No independent third-party penetration test has been completed and no pen-test report has been issued. An independent engagement is planned and the report will be published when issued. Continuous automated vulnerability scanning is in place today.
§ V · AI governance
AI surfaces inherit this boundary — they do not get an exception
No AI output enters the operating record as fact: every model output is written as a suggestion attributed to a named model version, and a human with the authority to be wrong has to accept it before it becomes part of the record.
PHI is not transmitted to third-party LLM providers and no LLM-provider BAA is in place. Operator data is not used to train or fine-tune any model. Model retrieval is constructed from rows the caller can already read under fail-closed RLS, so a model cannot widen a query past the identity that issued it. Autonomous writes to the record and autonomous regulatory submission are not permitted capabilities.
Full AI governance posture — use classes, framework mapping, non-claims§ VI · Artifacts available to vendor risk
HIPAA Security Rule control narrative
On request under NDAArchitecture and data-flow diagram pack
On request under NDATenant isolation design note
On request under NDAPHI storage and signed-URL handling note
On request under NDABAA template
On requestDPA with standard contractual clauses
On requestSub-processor register (role, data category, region)
On requestSIG Lite and CAIQ v4 responses
On request under NDAIncident-response and breach-notification runbook
In progressBusiness continuity and disaster-recovery plan
In progressSOC 2 report
Not issued — published when issuedPenetration test report
Not issued — published when issuedThe pgTAP isolation suite (operator-scoped RLS, cross-tenant access) was written against the prior schema and is being ported to Aurora + WorkOS in CI. Porting is remaining work and is not claimed as done.
Status model
Every security and compliance fact, at the lowest status we can support.
A fact is never described one status above its record. Statuses are the controlled terms defined in the evidence boundary above. Status record effective 2026-08-29.
Certification and regulatory facts
| Fact | Status | Statement | Source field |
|---|---|---|---|
| SOC 2 | PLANNED | SeniorCRE does not claim SOC 2 certification or a SOC 2 report. No auditor is engaged, no observation window is open, and no timeline is published. Control-readiness work is tracked internally alongside HIPAA. | canon.config.compliance.soc2 |
| HIPAA | IN PROGRESS | SeniorCRE implements the administrative, physical and technical safeguards applicable to its role under HIPAA and enters a Business Associate Agreement where required; status is as of the then-current date. | canon.config.compliance.hipaa |
| HITRUST | PLANNED | No HITRUST assessment has been performed and none is represented here. Status is held pending a decision to pursue assessment. | canon.config.compliance.hitrust (holding language) |
| ONC health IT certification | NOT PURSUED | SeniorCRE is not certified health IT and is not pursuing ONC / ASTP certification at this time. | canon.config.compliance.onc |
| Business Associate Agreement | IN PROGRESS | A counsel-reviewed BAA is entered where SeniorCRE acts as a business associate. Execution is a production-readiness gate before any PHI is processed. | canon.config.compliance.hipaa |
Availability, recovery and testing facts
| Fact | Status | Statement | Source field |
|---|---|---|---|
| Platform uptime | PLANNEDTarget, not a measured result | Multi-AZ deployment with health-checked failover. A monthly uptime figure is an engineering target; no measured availability record is published. | canon.config.compliance.targetsOnly — uptime |
| Recovery Time Objective (RTO) | PLANNEDTarget, not a measured result | An RTO is defined in the disaster-recovery design. It is a target: no recovery drill result is published. | canon.config.compliance.targetsOnly — RTO |
| Recovery Point Objective (RPO) | PLANNEDTarget, not a measured result | An RPO is defined against continuous transaction-log shipping with point-in-time recovery. It is a target: no restore drill result is published. | canon.config.compliance.targetsOnly — RPO |
| Backup retention | PLANNEDTarget, not a measured result | Encrypted snapshots are taken on a scheduled cadence. The retention window is a target until a restore test is recorded. | canon.config.compliance.targetsOnly — backup retention |
| Disaster recovery | PLANNEDTarget, not a measured result | A disaster-recovery runbook is in design. No DR exercise has been performed, so no drill outcome is claimed. | canon.config.compliance.targetsOnly — DR |
| Penetration testing | PLANNEDTarget, not a measured result | Continuous automated vulnerability scanning is implemented. No independent third-party penetration test has been completed and no report has been issued. | canon.config.compliance.targetsOnly — penetration testing |
| Incident response | PLANNEDTarget, not a measured result | A detection → triage → containment → notification workflow with named roles is documented. Notification obligations follow the HIPAA Breach Notification Rule. Response timing is a target; no incident exercise record is published. | canon.config.compliance.targetsOnly — incident response |
Availability, recovery, backup, disaster-recovery, penetration-testing and incident-response figures are engineering targets. A target is upgraded on this page only when an exercised or independently evidenced record exists.
Product capabilities retain the formal canon maturity taxonomy. Public readiness labels are Designed, Built, Operator deployment and Production evidence. Built describes component progress on demonstration data only, not implemented operating-record governance or operator validation. Security and compliance controls use their separate control-status vocabulary; no control status establishes operator deployment.
This brief describes controls enforced in shipped code and built, not yet validated. It is not an audit report, not an attestation, and not a representation of operator-production deployment. Assurance status is stated without target dates: no SOC 2 certification or report is claimed and each report is published when issued; no independent penetration test report has been issued. Trademarks are the property of their respective owners.