Security & Compliance

Certifications & Attestations

Prusik Health is built to meet the bar customers in regulated industries expect from their compliance vendor:

• HIPAA. We operate as a Business Associate under the HIPAA Security, Privacy, and Breach Notification Rules and execute a BAA with every customer that stores PHI.
• SOC 2 Type II. Independently audited against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. Reports are available under NDA on request.
• NIST CSF / 800-53 alignment. Our control framework maps to NIST CSF and the HIPAA-relevant 800-53 control families.

Data Protection

• Encryption in transit: TLS 1.3 (1.2 minimum) enforced on all connections, with HSTS.
• Encryption at rest: AES-256 on all primary databases and object storage. Especially sensitive secrets (e.g. TOTP/MFA seeds) are additionally encrypted at the application layer.
• Key management: application encryption and integrity keys are held in the server environment, never in source control, and are separate from database credentials.
• Backups: a documented restore procedure is maintained. Scheduled encrypted backups with point-in-time recovery are in progress and not yet in place; ask us for current status before relying on them.

Authentication & Access Controls

• NIST SP 800-63B aligned authentication: Argon2id password hashing and a breached-password check against known-compromised credentials.
• Strong MFA: via authenticator apps (TOTP), passkeys, or hardware security keys (FIDO2 / WebAuthn), enforceable per-organization policy.
• SSO/SAML, SCIM provisioning, and IP allowlisting are available on every plan.
• Role-based access control with least-privilege defaults.
• Server-side, revocable sessions with idle and absolute timeouts, configurable per-organization.
• Every action is written to a tamper-evident audit log. Each entry is SHA-256 hash-chained to the previous one, so any later alteration of a recorded entry is detectable (tail deletion is covered by the off-database checkpoints, not by the chain itself), and entries are retained for six years (per 45 CFR §164.530(j)(2)).

Application Security

• CSRF, XSS, SQL-injection, and SSRF defenses applied uniformly through framework-level controls
• Content Security Policy with per-request nonces; strict referrer and frame-ancestor policies
• Static analysis (PHPStan) on every commit across the core platform, gated in CI
• Annual third-party penetration test; security researchers can report vulnerabilities to [email protected]

Infrastructure

• U.S.-based hosting; current provider attestations are available on request
• Customer files stored outside the web root and served only through authenticated, org-scoped handlers; database credentials scoped to the application
• Vulnerability scanning with prioritized patching of critical CVEs
• DDoS protection and WAF in front of all public endpoints

Incident Response

We follow a documented incident-response plan with defined severity tiers and notification SLAs. Customers are notified of any security incident affecting their data within the timeframes required by our BAA and applicable law. For a breach of unsecured PHI our Business Associate Agreement commits us to notice in no case later than 30 days from discovery (shorter than the 60 days 45 CFR §164.410 allows a business associate), and typically much sooner.

Reporting a Vulnerability

Security researchers and customers can report vulnerabilities to [email protected]. We acknowledge reports within one business day and aim to triage within three. Coordinated disclosure preferred.

Trust Documents

Customers and prospects under NDA can request the following from [email protected]:

• SOC 2 Type II report
• Penetration-test executive summary
• HIPAA Security Rule mapping
• Subprocessor list
• Business continuity / disaster recovery plan summary