Security & compliance
What's in scope today, what's in the legal pipeline, and
what you can hand to your privacy officer. The HIA Information
Manager Agreement template is in lawyer review.
Read the privacy doc
Controls matrix
Data residency
Customer data is stored in a single, region-pinned facility
documented in the executed IMA / BAA. Canadian customers are
served from a Canadian-region facility; US customers from a
US-region facility. Region is locked at sign-up and confirmed
in the executed agreement. No cross-region replication, no
movement out of the chosen region without written notice.
The actual hosting provider, facility, and any third-party
attestations they currently hold (where they exist) are
documented in the executed IMA / BAA.
Encryption in transit
TLS 1.3 only on the public edge. Older protocol versions
disabled at the load balancer. Service-to-service calls
inside the VPC use mutual TLS. Certificate rotation is
automated.
SOC 2 Type II and ISO 27001 are on our certification roadmap
(not currently held).
Encryption at rest
AES-256 on every volume, snapshot, and backup.
Customer-managed keys are available on the Enterprise tier.
Patient pseudonyms (salted SHA-256)
Salted SHA-256 patient_hash on both the portal and FastAPI
paths, using the same patient-hash:v1 domain
format and PATIENT_HASH_PEPPER env var. Backed
by a hex CHECK constraint on the audit_trail SQL schema. The
FastAPI service fails fast at startup if
PATIENT_HASH_PEPPER is unset or shorter than 32
characters in production. Raw patient identifiers are stored
only in the encrypted encounter table, never in the audit
log.
Audit trail & chain
Every state-changing click (accept, dismiss, flag,
encounter upload, contact submission) is appended to a
hash-chained JSONL log. Each row's
cryptographic_signature is
SHA-256(prev_signature || tenant_id || user_id ||
event_type || timestamp || payload_canonical_json).
The chain can be verified at any time from the dashboard
(Privacy Officer mode). A privacy officer can re-export the
log and re-verify offline.
Access control
RBAC roles: viewer, biller,
admin, privacy_officer. Bearer
token auth on all mutating API endpoints. The
viewer role can read but not act on findings;
biller can accept/dismiss/flag; admin
manages users + audit chain; privacy_officer
can re-export the full chain.
Logging & monitoring
Structured JSON logs in production
(LOG_FORMAT=json). Prometheus
/metrics on every service. Healthz +
readyz endpoints. /status shows the
current live state.
Incident response
Security incident contact:
security@ashbi.ca. PGP key on request.
Target notification time: 24 hours from incident
confirmation.