Trust should be verifiable.Trust posture · last reviewed September 29, 2026

This page exists because enterprise InfoSec teams shouldn’t have to chase a salesperson for two weeks to learn what state a control is actually in. Every fact below renders at the lowest state our record supports.

Compliance posture — today vs. roadmap

SeniorCRE operates HIPAA-safeguarded security and privacy controls, including encryption at rest and in transit, role-based access control, and comprehensive audit logging. The platform is BAA-ready; operator BAA execution is a pilot-readiness gate and no LLM-provider BAA is in place. Multi-tenant architecture enforces data isolation between operators, with tenant-layer RLS hardening active. The underlying AWS infrastructure is covered by AWS’s own SOC assurance reports; SeniorCRE does not claim SOC 2 certification or its own SOC 2 report. Control-readiness evidence is collected internally alongside HIPAA, and any SeniorCRE SOC 2 report will be published only if and when one is issued.

• SOC 2: SeniorCRE does not claim SOC 2 certification or its own SOC 2 report. Infrastructure inherits AWS SOC 2 controls today.
• HITRUST: No HITRUST assessment has been performed and none is represented here.
• ONC: ONC health IT certification is not being pursued. No certification has been granted and no certification program is underway.
• HIPAA: SeniorCRE implements the administrative, physical and technical safeguards applicable to its role under HIPAA and enters a Business Associate Agreement where required; status is as of the then-current date.
• GDPR / CCPA: Data privacy, right to erasure, consent management, standard contractual clauses.
• State Licensing: Meets state-specific senior care regulations.
• Penetration Testing: No completed independent penetration-test report claimed; continuous automated vulnerability scanning in place today.
• Incident Response: Detection → triage → containment → notification workflow with named roles; 24/7 on-call rotation introduced with the enterprise tier; formal runbook maturing toward pilot go-live.
• Tenant Isolation: Operator isolation is enforced at the database layer by PostgreSQL Row-Level Security under a non-owner connection role — fail-closed, with endpoint filtering as defense-in-depth.
• Per-facility scope: Per-facility isolation is enforced in the application layer today, hardening in progress, with extension to database Row-Level Security under active evaluation alongside automated cross-facility isolation tests.
• Evidence porting: The pgTAP isolation suite (operator-scoped RLS, cross-tenant access) was written against the prior schema and is being ported to Aurora + WorkOS in CI. Porting is remaining work and is not claimed as done.

Evidence package — what we send vendor risk

The Trust-by-Design package is the single shipment to your vendor-risk team. Documents marked Today / On request are available after an executed NDA. Documents marked In draft are finalized and ratified before pilot kickoff — we will not back-date a runbook to look ready.

Why under NDA? Pre-SOC 2 organizations do not publish architecture diagrams or control narratives openly. The NDA is a standard mutual NDA.

Service-level posture

Claims & Evidence Policy. No clinical outcome, accuracy, or dollar-value figures are published. Capability ≠ outcome. SLA figures on this page are design targets until validated by the first disaster-recovery drill and an executed enterprise SLA addendum.

Data residency & isolation

What we are honest about

• SeniorCRE does not claim SOC 2 certification or its own SOC 2 report; reports are published only when issued.
• No completed independent penetration-test report claimed.
• Native mobile app is not claimed in production; current mobile experience is a responsive PWA.
• No on-platform payments. SeniorCRE customer billing is invoiced through NetSuite — no PCI scope.
• Availability, recovery, backup, DR, penetration-testing and incident-response figures are engineering targets, not exercised results.
• Diligence material is produced on request under NDA. There is no evidence library, because a library would imply audits that have not occurred.

Mutual NDA — download & execute

Most procurement teams start here. The SeniorCRE mutual NDA is a standard two-year, Texas-governed instrument that covers the Trust-by-Design package (SIG Lite, CAIQ, architecture diagrams, control narrative, incident response plan, and pen-test scope). Reasonable redlines are returned promptly.

How to request the full package

Once the NDA is executed, reply to your sponsor at SeniorCRE or contact us at support@seniorcre.com with an introduction to your vendor-risk lead.