Security at HASP — HIPAA infrastructure, encryption & audit

Trust Center — compliance posture → Data flow inventory → Data Processing Agreement → HIPAA-compliant AI — the complete guide → AI with a tamper-evident audit trail →

Infrastructure

Hosting: Global edge network (CDN, object storage, DNS, TLS) and a HIPAA-eligible compliance substrate (application hosting, managed database). Both layers hold SOC 2 Type II and ISO 27001 certifications.
Edge network: All traffic passes through a global edge CDN. TLS is terminated at the edge and enforced on every connection — no plaintext fallback.
Database: Managed database with automated backups and point-in-time recovery. Enterprise customers receive a dedicated cluster on dedicated cloud infrastructure — no shared database with other customers.
Monitoring: All platform components have 24/7 endpoint monitoring with automated alerting. Application errors are captured by an error tracking service. The endpoint monitor checks availability only — it receives no customer or personal data and is not a sub-processor.

Data protection

In transit: All connections use TLS 1.2+ enforced at the edge. HTTPS is required on every endpoint.
At rest: OAuth tokens encrypted with AES-256-CBC. Database encryption provided by managed hosting infrastructure.
Data isolation: Solo / Professional / Business: application-level tenant isolation with row-level security on a shared, compliance-certified cluster. Enterprise: dedicated data plane with restricted database users and IP firewall rules — cluster-level isolation, not logical multi-tenancy.
Backup: Managed database backups with point-in-time recovery. Enterprise: dedicated cluster with independent backup policy.
PHI handling: With an active BAA, PHI flows to BAA-covered inference providers under HASP's own agreements — no redaction required to stay compliant. Your organization chooses how PHI is handled at the AI gateway: allow it through under your BAA, redact it before it reaches a provider, or block it. When you choose redaction, scanning and re-identification run in HASP's own PHI anonymization pipeline (healthcare-specific recognizers running on managed compute inside the HASP compliance boundary) — never delegated to a third party. Requires a signed BAA — contact [email protected] to execute.

Authentication & access

Authentication: Passwordless only. HASP does not collect or store passwords. Sign-in via Google OAuth, Microsoft OAuth, and email magic links (15-minute expiry).
Enterprise SSO: SAML 2.0 single sign-on. Connect Okta, Azure AD, Google Workspace, or any SAML-compatible IdP. Available on Business and Enterprise plans.
SSO enforcement: Enterprise orgs can require SSO — OAuth and magic-link login are disabled for members when enforcement is active. Org owners retain an exemption to prevent lockout.
Role-based access: Three org roles (Owner, Admin, Member) plus per-app roles (Admin, Editor, Viewer). Access control is centrally managed by org administrators.
Session security: CSRF protection on all state-changing requests. Secure, HttpOnly session cookies. Automatic session expiry.
Staff access: Authorized HASP personnel may access a customer account session for support or investigation. All such access is recorded in an immutable audit log (impersonation.started / impersonation.ended) with staff and target user IDs.

For organizations that handle PHI, our operational tooling renders PHI as redacted placeholders by default — personnel cannot view unredacted PHI during routine support. Unredacted access is a separate path: it requires per-instance approval from one of your organization's administrators, is time-bounded (60 minutes by default), and is granted only for a specific operational reason. A break-glass exception exists for active security incidents — a single staff member may self-approve, your organization is notified immediately, and a mandatory post-incident review is completed within 24 hours.

Compliance

HIPAA: Full HIPAA controls: PHI scanning at the AI gateway, signed audit chain, dedicated data planes, BAA lifecycle management. PHI mode activates per organization upon BAA execution. Available on all paid plans.
GDPR: Consent capture, self-service data export (right to portability), account deletion (right to erasure), cookie consent banner, and a published DPA available for all customers.
CCPA: Supported via the same self-service data export and deletion capabilities.
PIPEDA: Compliant with Canada's Personal Information Protection and Electronic Documents Act. PIPEDA's ten fair-information principles are satisfied by the same control set that underpins GDPR compliance, with cross-border transfer accountability discharged through contractual clauses in our DPA.
Proposed CPPA (Bill C-27): Canada's Bill C-27 proposes the Consumer Privacy Protection Act as PIPEDA's successor. The bill is not yet law. HASP's existing control set is designed to satisfy it ahead of enactment — no new claims are made until the legislation comes into force.
Data residency: Enterprise customers receive a dedicated database cluster with region selection.
Audit logging: Immutable append-only audit trail on every paid plan. Records are Ed25519 hash-chained with RFC 3161 timestamp anchoring. Cryptographic chain integrity is verifiable without HASP software at every tier; Enterprise adds full-log CSV export. Verification recipe →
Audit retention: 7 years across every paid tier; Enterprise may configure longer per contract.
SOC 2: Not yet certified. SOC 2 Type II is on the roadmap. The underlying compliance substrate and edge network are SOC 2 certified. This page will be updated when HASP's own certification is complete.

Application security

Framework: Built on a mature application framework with security-by-default primitives, regular CVE patches, and an active security team.
Input validation: Server-side validation on all inputs via dedicated validation classes. Client-side validation is supplementary only.
CSRF protection: Automatic CSRF token verification on all state-changing requests.
XSS prevention: Strict Content Security Policy with per-request nonces. Customer-published apps execute on an isolated domain (usehasp.run) — a separate origin from the platform, enforcing browser-level isolation.
Rate limiting: Per-user and per-org rate limits on all API endpoints, tiered by plan.
Dependencies: Regular dependency updates with automated vulnerability scanning. Lock files committed for every package manager to prevent supply-chain drift.

Privacy

Privacy Policy: usehasp.com/privacy — how we collect, use, and protect your data.
Data Processing Agreement: usehasp.com/legal/dpa — governs processing of personal data on your behalf. Contact [email protected] to execute a countersigned copy.
Cookies: Product-analytics cookies (proxied through e.usehasp.com) are only loaded with explicit user consent via the cookie banner. Session cookies are strictly necessary. The runtime domain (usehasp.run) does not load third-party analytics on behalf of your app's end users.
Sub-processors: Full sub-processor list in the DPA and at Trust Center → Sub-processors. 30-day advance notice before any addition or material change.
Do Not Track: HASP honors the Do Not Track (DNT) browser signal. When DNT is enabled, analytics tracking is disabled.

Responsible disclosure

We appreciate researchers who help keep HASP and its customers safe. If you discover a vulnerability, please report it to us before public disclosure. We are committed to working with good-faith researchers and will not take legal action against researchers who follow this policy.

How to report

Email [email protected] with:

A description of the vulnerability
Steps to reproduce
The potential impact
Any proof-of-concept (code or screenshots)

What to expect

Acknowledgment within 2 business days
Status update within 7 days
Coordinated disclosure timing
No legal action for good-faith research

In scope

app.usehasp.com
usehasp.com
usehasp.run (runtime domain)

Out of scope: social engineering, physical attacks, third-party service vulnerabilities.

Security contacts

Security questions & disclosures

[email protected]

Vulnerability reports, pre-filled security questionnaires, vendor assessments.

Compliance & privacy

[email protected]

BAA execution, DPA requests, data subject rights, GDPR/CCPA inquiries.

Enterprise procurement

[email protected]

Enterprise security requirements, custom controls, pre-sales technical review.