Security & Compliance

Certifications & Attestations

Prusik Health is built to meet the bar customers in regulated industries expect from their compliance vendor:

• HIPAA. We operate as a Business Associate under the HIPAA Security, Privacy, and Breach Notification Rules and execute a BAA with every customer that stores PHI.
• SOC 2 Type II. Independently audited against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. Reports are available under NDA on request.
• NIST CSF / 800-53 alignment. Our control framework maps to NIST CSF and the HIPAA-relevant 800-53 control families.

Data Protection

• Encryption in transit: TLS 1.3 (1.2 minimum) enforced on all connections, with HSTS.
• Encryption at rest: AES-256 on all primary databases and object storage. Especially sensitive secrets (e.g. TOTP/MFA seeds) are additionally encrypted at the application layer.
• Key management: application encryption and integrity keys are held in the server environment, never in source control, and are separate from database credentials.
• Backups: a documented restore procedure is maintained. Scheduled encrypted backups with point-in-time recovery are in progress and not yet in place; ask us for current status before relying on them.

Authentication & Access Controls

• NIST SP 800-63B aligned authentication: Argon2id password hashing and a breached-password check against known-compromised credentials.
• Strong MFA: via authenticator apps (TOTP), passkeys, or hardware security keys (FIDO2 / WebAuthn), enforceable per-organization policy.
• SSO/SAML, SCIM provisioning, and IP allowlisting are available on every plan.
• Role-based access control with least-privilege defaults.
• Server-side, revocable sessions with idle and absolute timeouts, configurable per-organization.
• Every action is written to a tamper-evident audit log. Each entry is SHA-256 hash-chained to the previous one, so any later alteration or deletion is detectable, and entries are retained for six years (per 45 CFR §164.530(j)(2)).

Application Security

• CSRF, XSS, SQL-injection, and SSRF defenses applied uniformly through framework-level controls
• Content Security Policy with per-request nonces; strict referrer and frame-ancestor policies
• Static analysis on every commit; PHPStan at the strictest level on the core platform
• Annual third-party penetration test; security researchers can report vulnerabilities to [email protected]

Infrastructure

• U.S.-based hosting on SOC 2-attested cloud providers
• Network segmentation with private subnets for all data stores
• Vulnerability scanning with prioritized patching of critical CVEs
• DDoS protection and WAF in front of all public endpoints

Incident Response

We follow a documented incident-response plan with defined severity tiers and notification SLAs. Customers are notified of any security incident affecting their data within the timeframes required by our BAA and applicable law, and in no case later than 60 days from discovery of a reportable breach, and typically much sooner.

Reporting a Vulnerability

Security researchers and customers can report vulnerabilities to [email protected]. We acknowledge reports within one business day and aim to triage within three. Coordinated disclosure preferred.

Trust Documents

Customers and prospects under NDA can request the following from [email protected]:

• SOC 2 Type II report
• Penetration-test executive summary
• HIPAA Security Rule mapping
• Subprocessor list
• Business continuity / disaster recovery plan summary