Security & Compliance
Pause-Health.ai is a prototype-in-the-open today: no PHI is processed by the public demo, no BAAs are in force, and the formal certifications health systems will eventually require (SOC 2 Type II, HITRUST CSF) are planned milestones rather than current state. This page distinguishes today from designed-for-production at every control so a security reviewer can read the posture without translating marketing.
Today vs. Designed
Two columns per control. Today is what runs in the public prototype right now. Designed is the production posture pre-GA, mapped against HIPAA Security Rule + HITRUST CSF + SOC 2 Trust Services criteria. Same proto-vs-prod framing the rest of the site uses on /proposal/data and /proposal/integration.
No real PHI is processed by the prototype. Demo personas are synthetic, identity resolution runs against a seeded Salesforce sandbox, and grounding falls back to a deterministic mock when Salesforce isn't configured.
Production deployments handle PHI under BAA only; data minimization is the default and every grounding call is logged with patient + purpose attribution to the trace span.
No BAA in force. The company has zero health-system partners today; this is the pre-design-partner stage.
BAA executed with every provider organization before any access to PHI. Standard HHS-aligned terms, breach-notification SLA, sub-processor disclosure.
Administrative, physical, and technical safeguards designed against the Security Rule; not formally verified.
Full Security Rule control implementation with documented evidence, mapped against HITRUST CSF. Implementation roadmap on /proposal/data.
Audit not yet started. Type II requires 6-12 months of operating evidence which the company doesn't have yet.
Year-2 milestone alongside first production pilots. Type I as an interim milestone after design-partner kickoff.
Not yet pursued.
Health-system-aligned framework, planned after SOC 2 Type II to compress procurement reviews with IDN customers.
Inherits Vercel (TLS 1.3 in transit, AES-256 at rest on Vercel Edge / Postgres) and Salesforce platform defaults (TLS 1.2+, AES-256 KMS-managed). No custom crypto.
Same defaults at the platform layer plus per-tenant KMS keys for any first-party PHI store, with documented key rotation and break-glass procedures.
Salesforce OAuth Client Credentials for the live grounding path; no end-user identity surface in the prototype itself (the embedded chat uses Salesforce-hosted auth).
SAML / OIDC SSO with the customer's IdP, MFA enforced, RBAC mapped to clinical roles (clinician, MA, admin), full audit log to the trace store.
Every Care Router decision emits OpenTelemetry-style spans (intake -> identity -> grounding -> routing). Inspectable on /demo/agent-fabric.
Same span model, exported to the customer's SIEM (Splunk / Datadog / etc.) with PHI redaction and 6-year retention to align with HIPAA records requirements.
Three state license-sanction overlays run at directory build time: CA Medi-Cal Suspended & Ineligible (NPI-keyed), NY Professional Medical Conduct Board Actions (license-keyed cross-walk via NPPES), Texas Medical Board All-Licenses (license-keyed, active-disposition allowlist). The June 2026 build dropped 1,720 sanctioned candidates pre-rank — they cannot surface in any /api/mulesoft/providers response, the /provider UI, the agent's MCP tool, or the Care Router's recommendations. Survivors carry licenseStatus: "active" (verifiable per response under provenance.dataset.sanctionedFilteredBySource).
National coverage via a paid multi-state license-status feed (Verisys, ProviderTrust) replaces the per-state CSV cross-walk; existing CA/NY/TX overlays remain as redundant build-time sanity checks. Provider opt-out mechanism honored at the same build-time filter point. Sanctioned-provider drop counts continue to surface in the API response so the filter is verifiable by any consumer.
Reports accepted at security@pause-health.ai. The /.well-known/security.txt advertises the inbox per RFC 9116. The codebase is open at github.com/hucmaggie/pause-health.ai. GitHub Private Vulnerability Reporting is planned in the Now horizon of /roadmap (one-click toggle in repo Settings → Security; required for the 'Report a vulnerability' button to appear on the Security tab).
Public bug-bounty program post-GA, including a safe-harbor clause for good-faith research. GitHub Private Vulnerability Reporting acts as the in-tree intake until the bug-bounty program is funded.
Reporting a vulnerability
We accept good-faith vulnerability reports at security@pause-health.ai. The /.well-known/security.txt file advertises the inbox per RFC 9116. The codebase is public at github.com/hucmaggie/pause-health.ai if you want to file the issue there instead. We aim to acknowledge reports within 2 business days. A formal bug-bounty program with a safe-harbor clause is planned for post-GA.
