Security
A BAA before any real client data, and safeguards behind it.
Start in a sandbox on synthetic data. Real client data launch is pending verification that the exact DigitalOcean services in use are covered by the applicable provider agreement, followed by clinic activation. Accepting the clinic BAA is required, but does not by itself establish hosting or AI-provider coverage. These are the controls implemented today, and where the formal attestations stand.
The BAA comes first
A Business Associate Agreement is required before any real client data enters ABACare. The owner accepts it with one checkbox when naming the clinic: “I agree to the Terms of Service and the Business Associate Agreement.” An organization NPI is needed only to bill. The live demo uses synthetic records; use only synthetic records in the free sandbox too.
To read the BAA before you sign up, send us a request and we reply by email with the agreement. Inside the product, the owner accepts it with the checkbox when naming the clinic. Keep using synthetic records until real-data launch readiness is confirmed; the checkbox alone is not permission to upload real client data.
What is implemented
Each line below is a control that exists in the product today. Live claim submission to payers still needs a separate readiness review.
- Clinic-scoped data isolation. Clinic-scoped query controls and tested route coverage protect reports, search, AI retrieval and exports.
- Embedded OIDC sign-in via Clerk. No passwords are stored in ABACare. MFA is available. Access is role-aware: owner, BCBA, RBT, biller and parent each see only what their role permits.
- Encryption in transit and at rest. Traffic is encrypted with TLS. Managed PostgreSQL is encrypted at rest, and selected PHI columns are also encrypted in the application with AES-256-GCM. Secrets are held in encrypted App Platform environment variables, never in container images or source.
- Audit logs on PHI access. Audit-trail controls cover verified clinical workflows and record actor, action and time. Coverage of the remaining write paths is still being completed.
- Synthetic demo and sandbox use. The demo is the full product signed in to a fictional Demo Clinic seeded with synthetic records. Use only synthetic inputs in the demo and sandbox. Real clinical entry requires verified provider coverage and separate clinic activation; do not enter real records during evaluation.
AI drafts. A named person approves.
Clinical attestation never moves to a machine, at any accuracy. The chain shows who is holding it.
AI drafts
Organize evidence and prepare language. A draft never releases anything alone.
Clinician reviews
Qualified staff check sources, edits and risk context.
A named person approves
An accountable person releases or holds the action.
Role-based access control
Every access decision is checked on the server. The frontend mirrors the matrix only to decide what to draw, and the server applies additional entitlement and plan gating the client cannot see.
Certifications and audits
Where we are today, in plain language. No claims we cannot back.
- SOC 2 Type II, in progress. A target report window, not a current certification. Controls documentation is available under NDA for enterprise review.
- Independent penetration test, planned. A summary report goes to enterprise prospects under NDA once it is complete.
- HITRUST, available to scope. For clinics that require HITRUST as part of enterprise readiness.
- BAA, part of onboarding. A clinic Business Associate Agreement is required before real client data. Hosting and AI-provider agreements and feature eligibility must also be verified for the services used; clinic acceptance alone does not complete that review.
Subprocessors
The third parties that help us run ABACare, and the data boundary for each. PHI use requires applicable provider agreements and feature eligibility; naming a vendor here does not establish coverage for every service or feature.
| Vendor | Purpose | Data boundary |
|---|---|---|
| DigitalOcean | Production infrastructure: App Platform, Managed PostgreSQL, Managed Valkey, Spaces | US-hosted infrastructure with encryption, backups and clinic-scoped application controls. Verification of agreement coverage for the exact services in use is pending; real client data launch remains pending this review. |
| Anthropic | Direct Claude API for language, structured outputs, reasoning and vision: pinned Claude Haiku 5.5, Sonnet 5.5 and Opus 5.5 | PHI use requires the applicable Anthropic BAA, organization-level HIPAA configuration and a covered feature. Unsupported features are excluded from PHI workflows. |
| OpenAI | Specialty AI services: embeddings, transcription and speech | PHI use requires the applicable OpenAI agreement and an eligible endpoint and feature. General language and vision tasks route to the direct Claude API. |
| Clerk | Hosted sign-in (OIDC) and organization membership | Holds sign-in identity such as name and email; no clinical data |
| Stedi | Clearinghouse integration for eligibility (270/271), approved claim delivery (837P), and authenticated claim acknowledgments (277CA). Clinic enrollment and human approval control transmission. | Claim construction and validation happen in ABACare; nothing is delivered until the clinic's enrolled path is activated |
| Microsoft Graph | Mail transport for compliance notifications and parent portal communications | Family and staff messaging through approved clinic communications controls |
| Stripe | Billing: subscription and payment processing | No PHI boundary: never receives clinical data |
| Sentry | Observability and error monitoring | PHI scrubbed before transmission |
| PostHog | Product analytics | No PHI transmitted |
Common questions
- Will you sign a BAA?
- Yes. A signed Business Associate Agreement is required before any real client data enters ABACare. Request it on this page and we reply with the agreement, or accept it with the checkbox when you name your clinic. Real client data launch also requires verification of hosting coverage and the provider agreements and feature eligibility for each PHI workflow; that hosting review is currently pending.
- Where is data hosted?
- On DigitalOcean in the United States (New York region), in Managed PostgreSQL with automated backups and point-in-time recovery.
- Do you support SSO?
- ABACare handles sign-in over OIDC with embedded components today. SAML single sign-on through Okta, Azure AD or Google Workspace is not part of the current release.
- Can we get an audit report?
- Clinics can request a scoped audit log export at any time. We can share our current controls documentation on request. Ask where we are on formal third-party attestation.
- How is session video handled?
- Session video needs separate consents for recording, AI analysis and detector improvement. It is analyzed after the session, video only, with no audio processed. Raw video is deleted after the clinic's retention window (30 days by default) or when recording consent is withdrawn. Clips open through signed, short-lived links, and access is audited. Every output is reviewed by a clinician.
- How do you handle data export or deletion?
- Claims, authorizations and session notes can be exported as CSV or PDF, and each export is audited. On offboarding, we delete clinic data on request.