HIPAA Compliance & Security

Solution Compass is designed to meet the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Our platform implements administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI).

We offer Business Associate Agreements (BAAs) to all covered entities and their business associates. A signed BAA is required before any ePHI is processed on the platform. Contact us to initiate the BAA process.

• AES-256 encryption at rest for all stored documents, per organization
• TLS 1.2+ encryption for all data in transit
• Organization-specific encryption keys with no cross-tenant key sharing
• Private storage buckets with path-based access control

• Role-Based Access Control: Super Admin, Org Admin, Contributor
• Row-Level Security (RLS) enforced at the database level on every table
• Complete tenant isolation — users only see data from their organization
• Server-side role verification on all privileged operations
• Session timeout controls configurable per organization

• PII/PHI redaction filters on all external API responses (SSN, credit cards, emails, phone numbers)
• AI responses filter personal identifiers while retaining procedural knowledge
• No cross-tenant AI model training — organizational data is strictly isolated
• Configurable data retention policies per organization

• Comprehensive audit log of all user actions (logins, data access, role changes, exports)
• Document access logging with user ID, filename, org ID, and timestamps
• Chat question logging for quality assurance and compliance reporting
• Immutable audit records — logs cannot be modified or deleted by users
• Super admin access to platform-wide audit history

• Single-tenant, dedicated infrastructure — your data is not co-mingled in a shared multi-tenant cloud
• AI inference runs entirely on our own hardware. No prompt, document, or answer is ever sent to a third-party model provider such as OpenAI or Anthropic, so none of your content can be retained for model training
• US-based hosting; no offshore data processing
• DDoS protection and TLS termination at the network edge
• IP-based rate limiting on public-facing endpoints (5 requests / 15 minutes)
• HTTPS enforcement with strict security headers and a server-enforced Content Security Policy
• Security patching performed directly by the platform operator on a defined cadence, not deferred to a third-party host

• Email verification required before platform access
• Configurable password complexity requirements
• Leaked password protection (HaveIBeenPwned integration)
• Secure session management with configurable timeouts
• No anonymous sign-ups — all users must be invited or register with verified credentials

All integrations (SharePoint, Teams, ServiceNow, Confluence, PolicyTech, EHR systems, and the contract/scheduling/HR connectors in development) are configured at the organization level by that organization’s own administrators. Connector API credentials are encrypted at rest with the organization’s own encryption key, are never returned to the browser after saving, and are decryptable only by the server-side sync services. No ePHI is transmitted to third parties without explicit configuration and BAA coverage.