Security Posture

AI operates the workflow; source systems prove the facts; humans make every regulated decision, and every action is hash-chained, attributed, and replayable.

Reviewed: 2026-06-19 Posture: Pre-launch, HIPAA-alignedHIPAA posture06.2 HIPAA Posture Memo · canonical procurement-safe phrasing (not 'compliant' / not 'certified') · BAA availableBAA posture06.4 Vendor BAA Matrix · customer BAA template at 08.9, SOC 2 Type II in progressSOC 2 status06.3 SOC 2 Type II Plan · auditor selected, controls in implementation. Honest reporting only.

1. What we DO have

The running system operates on a synthetic corpus (43 roles × 51 jurisdictionsCoverage grid43 roles × 51 jurisdictions = 2,193 coverage cells · 11.3 + 07.7 × 36 sources); no real roster or paying PHI has run through it yet, pre-launchStage03.1 Company Overview · pre-launch by design, zero paying customers, zero signed pilots or design partners by design.

Transport security

• TLS 1.3 in transit on all public surfaces (rovn.to, passport.rovn.to, app.rovn.to)
• HSTS configured at Cloudflare + ALB
• Certificate pinning NOT in use (operational hazard for revocation; standard browser PKI suffices)

Data at rest

• AES-256 encryption on RDS instances (AWS KMS customer-managed keys)
• AES-256 encryption on S3 buckets (KMS keys)
• pgcrypto extension on PHI columns for application-layer encryption
• S3 Object Lock (COMPLIANCE mode, 7-year retention) on audit log bucket

Identity

• IAL2 identity verification via Persona (BAA executed)
• AWS Cognito for worker auth with phone + email + MFA
• WorkOS SSO for hospital users (SAML / OIDC)
• Admin auth dedicated path (admin_auth.py)
• MCP server bearer-token gated, tokens in AWS Secrets Manager

Audit

• Hash-chained audit log (PostgreSQL append-only table, per-row SHA-256 chained)
• Mirror to S3 with Object Lock (7-year retention, COMPLIANCE mode)
• Public replay endpoints (/audit/chain-head, /audit/events/recent)
• Every action is attributed to an actor (human or system) in the audit ledger; regulated clearance decisions route to a named human gate, with one legacy auto-clearance path scheduled for retirement (tracked in the AI Governance Memo)
• The hash-chained, attributed, replayable ledger is the moat: it is exactly the evidence a CMS recoupment audit or a Joint Commission / CMS surveyor PSV review demands, replayable on request.

Observability

• Sentry for error tracking with PHI scrubbing
• CloudWatch for logs and metrics
• Health endpoint /health for ECS health checks
• Sentry smoke endpoint /debug/sentry (admin-only) for wiring verification

IAM

• AWS IAM role-based access control
• Least-privilege per ECS task role
• No long-lived access keys in production code
• All vendor secrets in AWS Secrets Manager

Network

• RDS in private VPC subnets, no public ingress
• ECS Fargate tasks behind ALB
• Security groups locked to ECS task role
• VPC flow logs enabled
• AWS WAF PARTIAL, coverage on public surfaces in progress

2. What's IN PROGRESS

• SOC 2 Type II: Drata-managed evidence collection running; observation window open; report target Q3 2027
• Pentest: scheduled Q4 2026 (external firm to be selected)
• Incident response runbook: drafted (RUNBOOK.md, INCIDENT_RESPONSE.md), not yet exercised against a paying-customer incident
• AWS WAF tuned rules: basic CDN-layer rules live; tuned rules in progress
• Datadog / synthetic monitors: under counsel review
• PHI data classification map: informal today; formal data inventory in progress as part of SOC 2 evidence

3. What we explicitly do NOT claim

• ❌ Absolute PHI-breach-count claims, do not turn the absence of paying production PHI into a security claim. Say: pre-launchStage03.1 Company Overview · pre-launch by design, zero paying customers, zero signed pilots or design partners, PHI-minimized architecture, no known production PHI incidents, and no paying-customer PHI processed at scale yet.
• ❌ "147 of 152 SOC 2 controls implemented", control counts vary by audit firm and category. Drata reports continuous in-progress percentages. We will not weaponize a specific control count.
• ❌ "PagerDuty rotation", we have CloudWatch alarms + Sentry email + founder rotation. PagerDuty is a post-Series A formalization.
• ❌ "24/7 SOC", we have on-call rotation, not a 24/7 staffed security operations center.
• ❌ "FedRAMP", not in scope at this stage.
• ❌ "HITRUST CSF certified", self-assessment scheduled, certification customer-pull dependent.
• ❌ "ISO 27001 certified", not in scope.

4. PHI handling rules

1. PHI never leaves AWS HIPAA-eligible region (us-east-2AWS region07.2 AWS Infrastructure Memo · single-region ECS / RDS / S3 in us-east-2) without an active BAA at the destination.
2. PHI never transmitted to Sentry. Scrubber strips PHI before send; error frames replace PHI with redaction markers.
3. PHI never transmitted to Stripe, billing metadata only.
4. PHI never logged to CloudWatch in plaintext. Application-level log scrubbing.
5. PHI in document uploads encrypted at rest with KMS customer-managed keys; access via IAM-enforced API path only.
6. AI executor (Claude Haiku 4.5) receives PHI only through the AI chain (AWS BedrockAI provider chain07.3 AI Architecture · AWS Bedrock under BAA → Anthropic Claude Haiku 4.5 under BAA → Rōvn ECS under BAA → Anthropic Claude under BAA → Rōvn backend on ECS) with ZDR. Opus 4.7 advisor receives only redacted summaries unless the workflow explicitly requires PHI and is BAA-bounded.
7. PHI redaction migration 061 (phi_redaction_and_payer_db_gates) is the enforcement layer.

5. Access control posture

• Production database access: restricted to ECS task role + engineering on-call read-only role (audit-logged)
• AWS root account: locked, MFA-protected, founder-only
• Founder accounts: MFA-required, hardware key recommended (Yubikey)
• platform engineering embedded: federated via IAM Identity Center, time-bounded session tokens, least-privilege

6. Key rotation cadence

7. Vulnerability management

• Dependabot enabled on GitHub repos
• Container scanning via ECR image scan on push
• Application-layer dependency review per PR
• Critical CVE response SLA: 24 hours for production-impacting CVEs
• Pentest: Q4 2026 (annual cadence afterward)

8. Data retention

9. Customer-facing security artifacts

For any future enterprise pilot conversation, the artifact set is:

1. SOC 2 Type II audit progress report (Drata-managed, in-process; report target Q3 2027)
2. This security posture doc
3. Threat model (THREAT_MODEL.md)
4. Incident response runbook (INCIDENT_RESPONSE.md)
5. Sub-processor registry (SUB_PROCESSOR_REGISTRY.md)
6. BAA template
7. Pentest summary (TARGET Q4 2026)

End of security posture.