HIPAA-safeguarded controls today
Encryption at rest and in transit, role-based access control, immutable audit logging, BAA-ready posture. PHI buckets are private and require signed URLs; PHI is never returned as a public URL.
HIPAA-safeguarded controls. The underlying AWS infrastructure is covered by AWS’s own SOC assurance reports; SeniorCRE does not claim SOC 2 certification or its own SOC 2 report. Tenant isolation is enforced at the database layer by fail-closed Row-Level Security under a non-owner connection role.
Status model
A fact is never described one status above its record. Statuses are the controlled terms defined in the evidence boundary above. Status record effective 2026-08-29.
| Fact | Status | Statement | Source field |
|---|---|---|---|
| SOC 2 | PLANNED | SeniorCRE does not claim SOC 2 certification or a SOC 2 report. No auditor is engaged, no observation window is open, and no timeline is published. Control-readiness work is tracked internally alongside HIPAA. | canon.config.compliance.soc2 |
| HIPAA | IN PROGRESS | SeniorCRE implements the administrative, physical and technical safeguards applicable to its role under HIPAA and enters a Business Associate Agreement where required; status is as of the then-current date. | canon.config.compliance.hipaa |
| HITRUST | PLANNED | No HITRUST assessment has been performed and none is represented here. Status is held pending a decision to pursue assessment. | canon.config.compliance.hitrust (holding language) |
| ONC health IT certification | NOT PURSUED | SeniorCRE is not certified health IT and is not pursuing ONC / ASTP certification at this time. | canon.config.compliance.onc |
| Business Associate Agreement | IN PROGRESS | A counsel-reviewed BAA is entered where SeniorCRE acts as a business associate. Execution is a production-readiness gate before any PHI is processed. | canon.config.compliance.hipaa |
| Fact | Status | Statement | Source field |
|---|---|---|---|
| Platform uptime | PLANNEDTarget, not a measured result | Multi-AZ deployment with health-checked failover. A monthly uptime figure is an engineering target; no measured availability record is published. | canon.config.compliance.targetsOnly — uptime |
| Recovery Time Objective (RTO) | PLANNEDTarget, not a measured result | An RTO is defined in the disaster-recovery design. It is a target: no recovery drill result is published. | canon.config.compliance.targetsOnly — RTO |
| Recovery Point Objective (RPO) | PLANNEDTarget, not a measured result | An RPO is defined against continuous transaction-log shipping with point-in-time recovery. It is a target: no restore drill result is published. | canon.config.compliance.targetsOnly — RPO |
| Backup retention | PLANNEDTarget, not a measured result | Encrypted snapshots are taken on a scheduled cadence. The retention window is a target until a restore test is recorded. | canon.config.compliance.targetsOnly — backup retention |
| Disaster recovery | PLANNEDTarget, not a measured result | A disaster-recovery runbook is in design. No DR exercise has been performed, so no drill outcome is claimed. | canon.config.compliance.targetsOnly — DR |
| Penetration testing | PLANNEDTarget, not a measured result | Continuous automated vulnerability scanning is implemented. No independent third-party penetration test has been completed and no report has been issued. | canon.config.compliance.targetsOnly — penetration testing |
| Incident response | PLANNEDTarget, not a measured result | A detection → triage → containment → notification workflow with named roles is documented. Notification obligations follow the HIPAA Breach Notification Rule. Response timing is a target; no incident exercise record is published. | canon.config.compliance.targetsOnly — incident response |
Availability, recovery, backup, disaster-recovery, penetration-testing and incident-response figures are engineering targets. A target is upgraded on this page only when an exercised or independently evidenced record exists.
Product capabilities retain the formal canon maturity taxonomy. Public readiness labels are Designed, Built, Operator deployment and Production evidence. Built describes component progress on demonstration data only, not implemented operating-record governance or operator validation. Security and compliance controls use their separate control-status vocabulary; no control status establishes operator deployment.
Security posture
Every sentence below is sourced from a single internal compliance copy file so the answer the sales team gives in March is the same answer the CISO gives in November.
Encryption at rest and in transit, role-based access control, immutable audit logging, BAA-ready posture. PHI buckets are private and require signed URLs; PHI is never returned as a public URL.
The underlying AWS infrastructure is covered by AWS’s own SOC assurance reports. SeniorCRE does not yet have its own SOC 2 report, and AWS’s reports are not a SeniorCRE report.
Operator/tenant isolation is designed for enforcement at the database layer; the current-stack isolation test suite is incomplete. The design uses PostgreSQL Row-Level Security and a non-owner connection role. Endpoint-level filtering is defense-in-depth, not independent proof of isolation.
Per-facility isolation is enforced in the application layer today, hardening in progress, with extension to database Row-Level Security under active evaluation alongside automated cross-facility isolation tests.
TLS 1.2+ everywhere, AES-256 at rest. Signed-URL semantics on every PHI bucket. Application connects under a non-owner database role so RLS fails closed.
Immutable, append-only audit logs with UTC millisecond timestamps, full user/session context, and 7-year retention to support regulatory and forensic requirements.
Operational controls
WorkOS SSO, SAML, MFA, and role-based access are described in the platform architecture. Scope-specific authentication and privileged-access test evidence must be reviewed; no operator-production validation is implied.
Continuous automated vulnerability scanning today. No independent third-party penetration test has been completed and no report has been issued; an independent engagement is planned and the report will be published when issued. Incident-response requirements are documented; no exercised response time or monitoring service commitment is established here.
BAA available on request. SIG-Lite, HECVAT, and Trust-by-Design Procurement Package available through the Trust Center.
Honest disclosures
Per the Enterprise Roadmap, the following postures are deliberately not asserted. Procurement teams should hold us to this list.
Next step
Send your SIG-Lite, HECVAT, or vendor security questionnaire. We return a completed response grounded in the same compliance copy you see on this page — no marketing translation in between.