Security Policy¶

• US-only cloud and vendors for production PHI.
• Encryption in transit (TLS 1.2+) and at rest.
• Role-based access control with least privilege.
• Secrets in environment variables or a secret manager.
• PHI-free logs and telemetry.
• Incident response within regulatory timelines.