Security
Security Your Compliance Team Can Sign Off On
An overview of how Vagus protects protected health information. Ask us for more detail for your security review.
HIPAA Compliance
- Built for HIPAA. SOC 2 and HITRUST readiness is in progress; Vagus holds neither certification
- A Business Associate Agreement (BAA) is available to every customer
- Signed BAAs with Amazon Web Services, Paubox, Twilio and Google Workspace
- The Supabase BAA is not yet signed. It is signed at pilot onboarding, and production case intake stays closed until then
- PHI is handled under the minimum necessary standard: each role sees only what its work requires
Data Encryption
- TLS 1.2+ for all data in transit
- AES-256-GCM field-level encryption at rest, applied in the application before data reaches the database
- Encryption keys managed in AWS Key Management Service (KMS)
- Envelope encryption: every record gets its own data encryption key
- Patient identifiers such as names and dates of birth are stored in the database only as ciphertext
Access Control
- 8 role-based access levels with least-privilege defaults
- Row-level security (RLS) enforced in the database, not just the application
- Multi-tenant isolation: row-level security separates each organization's data
- Sessions end automatically after 15 minutes of inactivity
Authentication
- SAML 2.0 single sign-on, configured with your identity provider at onboarding
- Multi-factor authentication required for every user: an authenticator app (TOTP), or your identity provider's MFA for single sign-on organizations
- Password policy: at least 12 characters with upper- and lower-case letters, a number and a symbol
- One-time recovery codes for lost authenticator devices
Audit Logging
- An audit log entry for every PHI access, change and export
- Append-only audit trail that application users cannot edit or delete
- Each entry records who, what, and when, with before and after values and, where available, the IP address
- Audit logs retained for at least six years
AI Processing
- Scan Rx and invoice audit use AI document processing
- When enabled, AI document processing runs on AWS (Amazon Textract and Claude on Amazon Bedrock) under our AWS Business Associate Agreement
- PHI is not used to train models
- A provider reviews and signs every case created from a scanned Rx
Infrastructure
- US data residency (AWS US East)
- PHI never leaves the United States
- Hosting on AWS Amplify; database on Supabase PostgreSQL (US East)
- Encrypted, automated database backups
Operational Security
- Automated dependency and vulnerability monitoring
- Security headers on every response
- Rate limiting on authentication and invitation endpoints
- Schema validation and sanitization of API input
Security Resources
- Security whitepaper — coming soon. Ask for an early copy through the contact form.
- How our BAA works
Bring Your Security Questionnaire
We're happy to walk your IT and compliance teams through our architecture, policies and BAA.
Or email us at info@vagussolutions.com