Built for healthcare. Secured for HIPAA.

Your data is encrypted at rest and in transit

Encryption in transit. All data transmitted between your browser or mobile device and Align Care Hub is protected by TLS (HTTPS). Production traffic is served through automatic certificate management with HSTS (HTTP Strict Transport Security) enforced, including subdomains and preload eligibility, ensuring browsers never fall back to unencrypted connections.

Encryption at rest — infrastructure level. All database storage (Amazon RDS PostgreSQL) and document storage (Amazon S3) are encrypted at rest using a dedicated AWS KMS Customer Managed Key (CMK) with automatic annual key rotation enabled. Secrets and configuration values are stored in AWS Systems Manager Parameter Store as KMS-encrypted SecureStrings — never in source code, environment files, or application logs.

Encryption at rest — field level. High-sensitivity PHI and PII — including Social Security numbers, driver's license numbers, Medicaid identifiers, bank account details, and caregiver contact information for assigned participants — receive an additional layer of AES-256-GCM authenticated envelope encryption at the application level. Even in the unlikely event of unauthorized database access, these fields yield only ciphertext. Each encrypted value is tagged with a key identifier, enabling zero-downtime key rotation without data migration.

Cryptographic key separation. Encryption keys, JWT signing keys, audit-trail signing keys, and application-token secrets are strictly separated. A compromise of one key surface never weakens any other.

Boot-time cryptographic verification. In production environments, the application refuses to start if encryption keys are missing, misconfigured, or if development keys are detected alongside real PHI data. This fail-closed design ensures that configuration errors are caught before any data is served.

Strong authentication. Least-privilege access.

Password security. All passwords are hashed using Argon2id — the current industry-recommended password hashing algorithm, resistant to GPU-based and side-channel attacks. Plaintext passwords are never stored or logged.

Multi-Factor Authentication (MFA). TOTP-based multi-factor authentication is available for all users and enforced for platform operators (administrative staff with cross-tenant access). MFA verification is strictly rate-limited to prevent brute-force attempts. Web-console MFA requirements cannot be bypassed through mobile bearer tokens.

Session security. Sessions use __Host--prefixed cookies — the strongest cookie security model available — which are bound to the origin host, required to be Secure, and cannot be set or read by subdomains or scripts on other origins. Refresh token rotation follows RFC 9700 to prevent token replay. Access tokens are short-lived, limiting the window of exposure from any single compromised token.

Role-Based Access Control (RBAC). Align Care Hub implements approximately 80 discrete permission grants organized by functional area (e.g., employees.pii.read, documents.write, participants.read:assigned). Permissions follow the HIPAA "minimum necessary" principle — each user role receives only the access required for their job function. Every permission grant and revocation generates an audit event.

Agency-level tenant isolation. Align Care Hub is a multi-tenant platform. Each agency's data is logically isolated — caregivers working with multiple agencies control which agencies they connect to, and data from one agency is never disclosed to another. The platform operator console is separated onto its own application plane with dedicated routing and enforced MFA.

Every action is logged. Every log is verified.

Comprehensive audit logging. Every data mutation across the platform — creates, updates, status changes, deletions, and bulk operations — generates a structured audit record capturing the actor, IP address, user agent, timestamp, entity type, and full before/after JSON snapshots. This provides the information access activity record required by HIPAA §164.312(b).

Tamper-evident signatures. Every audit log entry is cryptographically signed using HMAC-SHA256 with a dedicated signing key (separate from all other cryptographic keys). Any modification to a logged record — even at the database level — is detectable because the signature will no longer match the row content. Row deletion is separately detected by gaps in the sequential record identifier.

Automated daily verification. A scheduled job runs daily to recompute and verify the HMAC signatures across the entire audit log, providing continuous assurance that the audit trail has not been silently altered. This tamper-detection mechanism satisfies HIPAA §164.312(c)(2) — mechanism to authenticate electronic PHI.

Retention policies that follow the regulations

Configurable retention periods. PHI records follow home-care industry retention requirements — commonly up to seven (7) years from the date of discharge. A daily automated sweep identifies discharged records that have reached the end of their retention period and flags them for administrative review.

Confirmed disposal. PHI disposal is never automated without human confirmation. Eligible records are surfaced for agency administrator review. Upon confirmation, PHI is redacted and the record returns HTTP 410 Gone — ensuring that stale data cannot be inadvertently accessed after disposal.

Legal hold support. Records subject to legal hold are exempt from automated retention sweeps, ensuring preservation of evidence when required by law or litigation.

Account deletion. Users can request account deletion at any time. After a 30-day grace period (allowing cancellation), identity-bearing data is permanently anonymized or deleted. Audit records and other data required by law are retained in a form stripped of personal identifiers.

Abandoned upload cleanup. Documents that fail to complete the upload process are automatically purged — including the underlying storage object — after a 48-hour grace window, preventing orphaned PHI from persisting indefinitely.

Hardened from the network edge to the database

No SSH access. Production servers have no open SSH port. All administrative access to the production environment is through AWS Systems Manager (SSM) Session Manager, which provides authenticated, audited, and encrypted sessions without exposing any network port.

Network isolation. The production database (Amazon RDS) resides in private subnets with no public accessibility and no default internet route. It accepts connections only from the application security group — never from the public internet. The application server sits in a public subnet with only ports 80 and 443 open (for HTTPS and Let's Encrypt certificate issuance).

Security headers. Every API response includes security headers aligned with industry best practices: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer (preventing PHI leakage through URL referrers), Permissions-Policy (disabling unnecessary browser APIs), Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cache-Control: no-store (ensuring PHI is not retained by browser or intermediary caches, per HIPAA §164.312).

CORS enforcement. Cross-Origin Resource Sharing is strictly configured per deployment environment. Wildcard origins are never permitted in production.

Input validation and PHI-safe error responses. All input is validated at the API boundary. Validation errors are sanitized before being returned to the client — rejected PHI input is never reflected back in error response bodies.

Rate limiting and abuse prevention. Sensitive endpoints (MFA verification, email dispatch, authentication) enforce strict per-client rate limits. Request body size limits prevent denial-of-service via oversized payloads. Image upload pipelines include decompression-bomb guards.

API documentation disabled in production. Swagger UI, ReDoc, and the OpenAPI specification endpoint are completely disabled in the production environment to minimize the attack surface.

Documents protected at every stage

Encrypted document storage. All uploaded documents — caregiver credentials, participant care records, signed forms, identification documents — are stored in Amazon S3 with server-side encryption using the dedicated KMS Customer Managed Key (SSE-KMS). Documents are accessible only through authenticated, authorized API requests — never via direct public URLs.

S3 versioning. Bucket versioning is enabled, ensuring that every version of every document is retained. Accidental deletions or overwrites are recoverable by restoring a prior version. Block Public Access is enforced at the bucket level.

Push notification privacy. Mobile push notification previews are intentionally generic and do not include health details on the device lock screen, preventing inadvertent PHI disclosure on shared or visible devices.

Biometric authentication. When the mobile app uses biometric verification (fingerprint or face recognition) for sensitive actions, all biometric matching is performed entirely by the device operating system. Align Care Hub never receives, transmits, or stores biometric data.

Designed to recover. Tested quarterly.

Automated database backups. Amazon RDS automated backups with a 7–14 day retention window provide point-in-time recovery to within approximately 5 minutes of any moment during the retention period. All backups are encrypted with the same KMS CMK that protects live data.

Document durability. S3 versioning provides continuous protection for all stored documents. Combined with S3's 99.999999999% (11 nines) durability design, document loss risk is minimized.

Defined recovery objectives. The platform maintains documented Recovery Point Objectives (RPO) of approximately 5 minutes for database data and near-zero for documents, with Recovery Time Objectives (RTO) of 15–40 minutes for database restoration and under 30 minutes for full application rebuild.

Stateless application architecture. The application tier is fully stateless — no PHI resides on the application server. A host failure is recoverable by provisioning a new instance from the versioned codebase and KMS-encrypted secrets, without any data loss.

Quarterly recovery drills. The disaster recovery runbook requires quarterly drills: a point-in-time database restore to a throwaway instance, verification that encrypted PHI decrypts correctly (proving crypto-key/snapshot alignment), S3 version restoration, and audit-trail tamper verification against the restored data. Each drill is timed against the documented recovery objectives.

Every vendor held to the same standard

Align Care Hub uses a small, vetted set of infrastructure vendors — each operating under contracts that restrict their use of data and, where PHI is involved, under signed HIPAA Business Associate Agreements:

BAA boot gate. The application enforces a runtime check: if a PHI-handling subprocessor (such as S3 or SES) is enabled without the corresponding BAA configuration acknowledged, the application refuses to start. This prevents accidental deployment against uncovered infrastructure.

No third-party analytics or advertising. Align Care Hub does not use third-party advertising SDKs, analytics trackers, or cross-site tracking. The platform does not sell personal information or use it for behavioral advertising.

Proactive scanning. Documented remediation.

Routine dependency auditing. The codebase includes automated dependency vulnerability scanning (pip-audit) run before releases. All findings are documented with their remediation status, exposure assessment, and any mitigating controls in place.

Documented security fixes. Security-impacting dependency updates and vulnerability remediations are tracked with full context: the CVE or advisory identifier, the actual exposure path in the application, the fix applied, and the test suite verifying the remediation.

Responsible deferral. When a vulnerability fix requires a major framework upgrade that carries regression risk, it is deferred only with documented rationale, a verified assessment that the exposure is mitigated at the application layer, and a tracking entry for follow-up.

Our commitments to you

• Business Associate Agreements. We execute BAAs with every agency customer and with every subprocessor that handles PHI on our behalf.
• HIPAA Security Rule safeguards. We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of ePHI.
• Breach notification. In the event of a breach of unsecured PHI, we will notify affected agencies in accordance with HIPAA breach notification requirements (45 CFR §§164.404–164.410).
• Individual rights. We support agencies in fulfilling individual rights requests (access, amendment, accounting of disclosures) by providing the technical mechanisms and data access needed to respond.
• Minimum necessary. Our RBAC system and permission model are designed to enforce the HIPAA minimum necessary standard — users access only the information required for their role.
• Workforce training. Platform operator access requires MFA, and the operator console is separated from tenant operations to enforce access boundaries.

We're happy to discuss our security controls, provide additional detail for your compliance review, or execute a Business Associate Agreement.

Align Care Hub · aligncarehub@gmail.com

Pittsburgh, Pennsylvania, USA