Access control
Multi-factor sign-in
Workforce accounts require multi-factor authentication. Self-registration is off.
Least privilege
Every route checks the user’s role before it runs.
Practice isolation
Database row-level security keeps each practice’s data separate, independently of application code. The application’s database role cannot bypass it.
Audited access
Viewing patient lists and documents, changing records, reviews, and automated actions all produce audit events.
Data protection
- Encryption in transit with verified TLS, including database connections
- Documents encrypted at rest with rotating, customer-managed keys
- Document download links expire after 60 seconds
- Application logs redact request bodies, credentials, and patient details
- Development and testing use synthetic data only
Tamper-evident audit log
Audit records are append-only and linked per practice with SHA-256 hashes, so any unauthorized change is detectable.
Safety and billing guardrails
Rules before AI
Named red-flag symptoms always escalate to a person. AI cannot clear emergency guidance.
Human review
Every monthly episode has an accountable owner. Internal review comes before practice review.
No automated claims
Compound Care exports evidence. It has no claim-submission integration.
Gated outreach
Live patient outreach stays off until the practice’s scripts, quiet hours, and escalation paths are approved.
Agreements and reviews
Business associate agreements with the practice and our vendors are in place before any live patient data is used. For security questionnaires or documentation, email hello@compoundcare.co.