Ask where the boundary is enforced, not whether it exists.
Operator/tenant isolation is enforced at the database layer by PostgreSQL Row-Level Security evaluated under a non-owner connection role, so it fails closed: without tenant context the policies return zero rows rather than another operator’s rows. API-layer tenant and role gates are defense-in-depth, not the primary boundary. PHI has no public retrieval path — PHI buckets are private and objects are served through short-lived signed URLs minted per authenticated request, with the object path stored rather than a resolved URL. A counsel-reviewed Business Associate Agreement is available and its execution is a pilot-readiness gate. Assurance status is stated without target dates.
Tenant isolation model
Five boundaries, outermost to innermost: identity (SSO with mandatory MFA on administrative roles), API/transport (tenant and role gates applied before a query is composed), database operator/tenant scope (Row-Level Security under a non-owner role), database facility scope, and privileged database routines.
Per-facility isolation is enforced in the application layer today, with extension to database Row-Level Security under active evaluation alongside automated cross-facility isolation tests. That is disclosed as application-layer rather than represented as database-enforced.
Elevated database routines are explicitly enumerated, set an explicit search path, and are not granted to anonymous or general authenticated roles. Role membership lives in a dedicated role table and never on a profile record, so a role claim carried in client storage cannot grant privilege.
PHI storage and signed-URL handling
Buckets that can hold PHI — resident photos, staff photos, family communications, resident documents, therapy photos — are private. Marketing and brand assets live in separate public buckets, so the classification decision is made at the bucket rather than per file.
Signed URLs expire well inside their maximum validity window and client caching is deliberately set below the expiry, so an expired link is re-minted rather than surfaced as a broken clinical asset. Access is re-authorized on every read, which means revoking a user revokes their access to the object.
PHI is processed and stored in United States regions with encrypted backups to a second US region. Encryption covers application, database, object storage and backups, with managed key material and rotation.
BAA readiness
A counsel-reviewed Business Associate Agreement is available and is executed with every covered-entity customer; PHI does not move before signature. Sub-processors that can touch PHI are enumerated with role, data category and region, and are required to be under BAA before being placed in a PHI path.
No model-provider BAA is in place. Until one is, no PHI is routed to a third-party model provider, and intelligence features that would require it stay scoped to de-identified or non-PHI inputs.
Operators export the full canonical model on demand. Termination triggers an export window followed by verified deletion — no export penalty and no hostage data.
Assurance posture, including what has not been done
SeniorCRE is not SOC 2 attested. Type I and Type II work is in progress and each report is published when it is issued; no target date is published, because a dated assurance claim has to be corrected every time an observation window moves. Underlying infrastructure inherits its provider’s SOC 2 controls today.
No independent third-party penetration test has been completed and no pen-test report has been issued. An independent engagement is planned and the report will be published when issued. Continuous automated vulnerability scanning is in place today.
HIPAA has no certification to claim, so the reviewable artifact is a control narrative mapping HIPAA Security Rule requirements to platform behavior, available under NDA. There is no completed operator pilot and no integration running in operator production; controls described here are enforced in shipped code and exercised in SeniorCRE-operated validation environments.
The database isolation test suite was written against the prior schema and is being ported into CI on the current stack. The Row-Level Security policies are enforced today; the automated proof of them is being rebuilt, and that is remaining work rather than a completed control.
https://seniorcre.com/security-architecture