Trust & Security

Live security posture

Each row below is enforced by a CI gate on every pull request. A red gate blocks merge to main, so the dates here are the dates the gate last enforced its invariant on production code.

Audit chain SHA-256 integrityPASS · 2026-06-12

Every AuditEntry's hash chain links — tampering would surface within one CI run. scripts/verify-audit-hash-chain.ts

Retention worker isolationPASS · 2026-06-12

Hospital A's retention override never mutates Hospital B's records. scripts/verify-retention-worker.ts

Row-Level Security activationPASS · 2026-06-12

25 RLS invariants over per-tenant scopes — fail-closed on misconfiguration. scripts/verify-rls-activation.ts

Multi-tenant fail-closedPASS · 2026-06-12

Cross-tenant query without explicit opt-in throws — verified in CI on every PR. scripts/verify-tenant-isolation.ts

KMS envelope encryptionPASS · 2026-06-12

21 round-trip invariants + tamper-detection on encrypted attachments. scripts/verify-kms-roundtrip.ts

DICOM PHI envelope encryptionPASS · 2026-06-12

8 invariants: encrypt/decrypt round-trip + IV uniqueness + AEAD tamper + serializer omission. scripts/verify-dicom-phi-encryption.ts

Backup + restore parity (DR)PASS · 2026-06-12

Quarterly drill: backup → restore → schema parity. Last drill is recorded in the audit chain. scripts/ci-backup-drill.sh

HTTP security headersPASS · 2026-06-12

HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — 8/8 PASS. scripts/verify-security-headers.sh

TOTP (RFC 6238) E2EPASS · 2026-06-12

10-step enroll → verify → logout → re-login (challenge) → disable cycle. scripts/verify-totp-flow.sh

OIDC SSO Authorization CodePASS · 2026-06-12

5-step live drive against Keycloak: start → form-POST → callback → /me with role mapping. scripts/verify-oidc-keycloak-smoke.sh

Faz 0 AI — similar cases isolationPASS · 2026-06-12

Hospital A's case never surfaces in Hospital B's advisory even with byte-identical titles; 5 invariants verified. scripts/verify-similar-cases.ts

Appointment workflow lifecyclePASS · 2026-06-12

Provider working-hours guard + AppointmentStatus state machine (scheduled→confirmed→checked_in→in_progress→completed; terminal states block). scripts/verify-appointment-lifecycle.ts

Faz 1 AI provider + PHI redactionPASS · 2026-06-12

Disabled by default + hospital consent gate + PHI redaction + clinical-safety disclaimer seam. 6 invariants. scripts/verify-ai-adapter.ts

AI endpoint EU residencyPASS · 2026-06-12

AI_API_BASE_URL must be on-prem, AWS Bedrock EU, or Azure OpenAI EU. OpenAI proper rejected unless explicit DPO+CISO override. scripts/verify-ai-residency.ts

Hospital AI consent togglePASS · 2026-06-12

RBAC + confirmation token + agreementVersion check + audit trail on every AI advisory consent change. 5 invariants. scripts/verify-ai-consent.ts

PSA hospital onboarding atomicPASS · 2026-06-12

PSA atomic Hospital + Admin + Invite create; PSA-only RBAC; idempotency; audit trail. 5 invariants. scripts/verify-platform-onboarding.ts

Faz 0.5 semantic embeddings + hybrid similarPASS · 2026-06-12

Embedding adapter contract + cosine math + hybrid endpoint reranks identical-embedding neighbour to #1; trigram fallback on null. 6 invariants. scripts/verify-embeddings.ts

CMO AI metrics + feedbackPASS · 2026-06-12

Per-hospital AI invocation aggregation + thumbs-up/down feedback collection + model drift detection. 5 invariants. scripts/verify-ai-metrics.ts

Sales demo data integrityPASS · 2026-06-12

Base demo tenant + 3 clinical scenarios + consultations + --reset idempotency. 4 invariants. scripts/verify-demo-data.ts

Last DR drill: 2026-06-12 · Last penetration test: Scheduled 2026 Q3 (CREST-accredited) · Last dependency audit: 2026-06-12 · JSON

Certifications

Our compliance roadmap. Active items are operational today; in-progress items are in their observation or pre-audit phase.

• ISO 27001 (in-progress) — Information Security Management System. Audit-readiness assessment in progress; target certification 2026 Q4.
• SOC 2 Type II (in-progress) — Service Organization Control 2 — security, availability, confidentiality. Type II observation window opens 2026 Q3.
• KVKK (Türkiye) (active) — Compliant with the Personal Data Protection Law (KVKK). Lawful basis under Md. 6 (special-category health data) documented; DSAR endpoint live under Md. 11.
• GDPR (EU/EEA) (active) — Compliant with the GDPR. Art. 28 Data Processing Agreement template published at /dpa; Art. 9(2)(h) clinical basis documented.
• UZ PDL (O'zbekiston) (active) — Compliant with Uzbekistan's Personal Data Law. Art. 17 medical-purpose basis documented; data residency in country by default.

Sub-processors

Vendors that process personal data on our behalf. Hospitals are notified at least 30 days before any addition or change. Data residency is regional — TR deployments stay in Türkiye, UZ deployments stay in Uzbekistan.

• PostgreSQL on managed Aurora (Per-region (TR / UZ / EU)) — Primary clinical database (cases, consultations, audit log, attachments metadata).
• Object storage (S3-compatible) (Per-region (TR / UZ / EU)) — Encrypted-at-rest storage for case attachments — DICOM, PDF, JPEG.
• Postmark / SMTP relay (EU / regional fallback) — Transactional email (invites, password resets, case-event notifications).
• Sentry (EU) — Server-side error capture. Configured to scrub bodies + headers so no clinical content reaches the vendor.

Security controls

The non-obvious controls that survive an external pen-test and a hospital security review.

• Strict tenant isolation — Every tenant-owned model carries a hospitalId column. The Prisma client is wrapped with a $extends({ query }) policy that rejects any read or write missing a tenant context — by default fail-closed. Cross-tenant access requires an explicitly-marked privileged context.
• Tamper-evident audit log — Every clinical action (case created, status changed, attachment downloaded, consultation submitted) is written to an append-only AuditEntry table. Postgres triggers reject UPDATE, DELETE, and TRUNCATE — even a database superuser cannot quietly rewrite history. Each row is hashed and chained to the previous row's hash; a corrupted row breaks the chain on recompute.
• Encryption in transit and at rest — TLS 1.2+ for all client traffic. Postgres + object storage encrypted at rest. iron-session cookies are signed and httpOnly.
• MFA + session revocation — TOTP MFA with recovery codes; required for hospital administrators. Sessions carry a user.sessionEpoch — incrementing the epoch revokes every active session for that user, used by 'Sign out everywhere' and account-recovery flows.
• CSRF protection — Mutating /api/* routes require a same-origin Origin (or Referer fallback). sameSite=lax cookies block top-level navigation CSRF; the Origin check closes the residual subresource attack surface without the moving parts of a CSRF-token store.
• Per-IP rate limiting — Brute-force-sensitive endpoints (login, password reset, TOTP verify, invite creation) are capped per-IP with HTTP 429 + Retry-After. Login uses an account-level lockout in addition (5 failures → 15 min).
• One-click DSAR export — Authenticated clinicians can self-serve their data export via /api/auth/dsar/export. Returns a portable JSON snapshot of the user's account record and authored cases — KVKK Md. 11, GDPR Art. 15, UZ PDL Art. 22.
• Backup markers + quarterly restore drills — An ops-level BackupMarker ledger records snapshot, restore-drill, and disaster-drill events so SRE can correlate them with the audit table. Restore drills run quarterly with the result recorded in the audit chain.

Contact

Questions: security@cccp.health. Vulnerability reports follow our responsible-disclosure policy (90-day window; safe-harbor for good-faith testing).