Security & Data Handling

Every organization’s data is isolated at the database layer using row-level security policies. Server-side routes independently verify organization membership before any read or write — defense in depth, not a single control.

Uploaded denial letters, clinical records, and payer correspondence are never modified by CareState. AI-proposed revisions are applied only to generated work product, never to the source file.

Every AI-extracted finding lands in a review queue with status needs_review. A qualified reviewer must explicitly accept or reject it. Generated appeal documents mark unreviewed findings as pending review.

Every review action — who, when, what changed, what note was recorded — is written to an append-only audit log with the reviewer identity and timestamp. Exportable as CSV for compliance review.

Every finding carries a verbatim quote from the source document and its location. Citations are validated against the source text and checked for scope and polarity by a second verification pass.

All traffic uses TLS. Documents and database records are encrypted at rest by the underlying platform providers.

Organization roles (owner, admin, reviewer, member) are enforced server-side. Only owners and admins can invite members, change roles, or access the admin console.

Documents enter CareState only through explicit user upload. CareState does not connect to, crawl, or sync from customer systems during private preview.

Handling protected health information under a Business Associate Agreement is a core enterprise requirement. Readiness work — safeguards mapping, access review, and BAA templates — is planned and will be confirmed in writing before any PHI pilot.

A SOC 2 audit is planned. Internal readiness work — policy inventory, evidence collection, access control review, incident response planning — is underway. We will publish the report only once an audit is complete.

ISO 27001 is a future enterprise compliance consideration, sequenced after SOC 2.

True SSO integration with Okta, Entra ID, and other identity providers can be discussed and configured during enterprise pilot onboarding. Okta Bookmark Tile access is available now — note that a bookmark tile is not SSO.

Automated user provisioning and deprovisioning from your identity provider. Currently, pilot users are provisioned manually by an organization admin.

Bring-your-own storage bucket so documents never leave your cloud tenancy. Under evaluation for enterprise pilots.

Per-organization retention policies and scheduled deletion. Currently, data is retained for the duration of the pilot and deleted on request.

SharePoint, OneDrive, Box, and S3 connectors are on the roadmap and will be prioritized by customer requirements. CareState currently supports controlled manual upload only.

Programmatic access is planned. It will not be released until authentication, permissions, rate limiting, and audit logging are production-ready.