HIPAA infrastructure, encryption & data security

Infrastructure

Hosting

HIPAA-eligible AWS services under the AWS BAA, end to end: the global edge network (TLS termination and web application firewall), application hosting, managed database, and S3 file storage and backups.

Edge network

All traffic passes through a global edge CDN. TLS is terminated at the edge and enforced on every connection — no plaintext fallback.

Database

Managed database with automated backups and point-in-time recovery. Enterprise customers receive a dedicated cluster on dedicated cloud infrastructure.

Monitoring

All platform components have 24/7 endpoint monitoring with automated alerting. Application errors are captured by an error tracking service. The endpoint monitor checks availability only — it receives no customer or personal data and is not a sub-processor.

Authentication & access

Authentication

Passwordless only. HASP does not collect or store passwords. Sign-in via Google OAuth, Microsoft OAuth, and email magic links (15-minute expiry).

Enterprise SSO

SAML 2.0 single sign-on. Connect Okta, Azure AD, Google Workspace, or any SAML-compatible IdP. Available on Business and Enterprise plans.

SSO enforcement

Enterprise orgs can require SSO — OAuth and magic-link login are disabled for members when enforcement is active. Org owners retain an exemption to prevent lockout.

Role-based access

Three org roles (Owner, Admin, Member) plus per-app roles (Admin, Editor, Viewer). Access control is centrally managed by org administrators.

Session security

CSRF protection on all state-changing requests. Secure, HttpOnly session cookies. Automatic session expiry.

Staff access

For organizations that do not handle PHI, authorized HASP personnel may access a customer account session for support or investigation, with a stated reason and a 60-minute limit. All such access is recorded in an immutable audit log (impersonation.started / impersonation.ended) and your administrators are notified.

For organizations that handle PHI, personnel access a customer account session only when one of your organization's administrators approves that specific session: which staff member, which user, read-only or read-and-write, and for how long. Your administrators can revoke it at any time, and every request made during it is recorded in your audit log. Our operational tooling renders PHI as redacted placeholders by default, so personnel cannot view unredacted PHI during routine support. Viewing a specific record's PHI is a separate, read-only path: personnel request the exact records, and one of your organization's administrators approves all of them, only some, or none — an undecided request lapses. Approved access is limited to those records and time-bounded (60 minutes by default). A break-glass exception exists for active security incidents: it never accesses an account session, it is limited to 60 minutes, your organization is notified every time, and a written post-incident review follows promptly. Every record personnel open is recorded in your audit log.

Application security

Framework

Built on a mature application framework with security-by-default primitives, regular CVE patches, and an active security team.

Input validation

Server-side validation on all inputs via dedicated validation classes. Client-side validation is supplementary only.

CSRF protection

Automatic CSRF token verification on all state-changing requests.

XSS prevention

Strict Content Security Policy with per-request nonces. Customer-published apps execute on an isolated domain (usehasp.run) — a separate origin from the platform, enforcing browser-level isolation.

Rate limiting

Per-user and per-org rate limits on all API endpoints, tiered by plan.

Dependencies

Regular dependency updates with automated vulnerability scanning. Lock files committed for every package manager to prevent supply-chain drift.

Responsible disclosure

We appreciate researchers who help keep HASP and its customers safe. If you discover a vulnerability, please report it to us before public disclosure. We are committed to working with good-faith researchers and will not take legal action against researchers who follow this policy.