Security & Data Handling

Tables holding operational customer data grant no direct client database access — every read and write goes through a server-side route that derives your organization and checks capability before touching a record. Two identity tables used for sign-up and membership resolution are the deliberate exception and are protected by row-level security.

Uploaded denial letters, clinical records, and payer correspondence are never modified by CareState. AI-proposed revisions are applied only to generated work product, never to the source file.

Every AI-extracted finding lands in a review queue with status needs_review. A qualified reviewer must explicitly accept or reject it. Generated appeal documents mark unreviewed findings as pending review.

Every review action — who, when, what changed, what note was recorded — is written to an append-only audit log with the reviewer identity and timestamp. Exportable as CSV for compliance review.

Every finding carries a verbatim quote from the source document and its location. Citations are validated against the source text and checked for scope and polarity by a second verification pass.

All traffic uses TLS in transit, and documents and database records are encrypted at rest by the underlying platform providers. Formal provider/configuration documentation of these controls is being assembled and is not yet published.

Organization roles (owner, admin, reviewer, member) are enforced server-side. Only owners and admins can invite members, change roles, or access the admin console.

Documents enter CareState only through explicit user upload, which is validated (type, size, and content signature) before processing. CareState does not crawl, sync, or connect to customer repositories, mailboxes, or drives during private preview. Forward-to-intake email is planned and will not be enabled until it is built against the provider's verified receive contract.

Handling protected health information under a Business Associate Agreement is a core enterprise requirement. Readiness work — safeguards mapping, access review, and BAA templates — is planned and will be confirmed in writing before any PHI pilot.

A SOC 2 audit is planned. Internal readiness work — policy inventory, evidence collection, access control review, incident response planning — is underway. We will publish the report only once an audit is complete.

ISO 27001 is a future enterprise compliance consideration, sequenced after SOC 2.

True SSO integration with Okta, Entra ID, and other identity providers can be discussed and configured during enterprise pilot onboarding. Okta Bookmark Tile access is available now — note that a bookmark tile is not SSO.

Automated user provisioning and deprovisioning from your identity provider. Currently, pilot users are provisioned manually by an organization admin.

Bring-your-own storage bucket so documents never leave your cloud tenancy. Under evaluation for enterprise pilots.

Per-organization retention policies and scheduled deletion. Currently, data is retained for the duration of the pilot and deleted on request.

SharePoint, OneDrive, Box, and S3 connectors are on the roadmap and will be prioritized by customer requirements. CareState currently supports manual upload only — it does not connect to or pull from your repositories.

Programmatic access is planned. It will not be released until authentication, permissions, rate limiting, and audit logging are production-ready.