01 / Security
Security and HIPAA, without asterisks.
Every statement on this page is one we can show an auditor.
02 / Practices
Seven practices we can show an auditor.
01Business Associate AgreementLongevityGraph is a HIPAA business associate. Practices accept our BAA at registration, as part of the Provider Terms.
02HostingA single AWS region (us-east-2) under an executed AWS BAA. The application server accepts traffic only through our edge, has no public SSH, and is administered through audited AWS Systems Manager sessions.
03EncryptionData at rest is encrypted in PostgreSQL (AWS RDS, customer-managed KMS keys) and in object storage (S3, SSE-KMS). Data in transit uses TLS, with HSTS preload, and database connections require SSL.
04AccessMulti-factor authentication with an authenticator app or a passkey. Sessions expire after inactivity. Every request is scoped to the user's practice.
05AuditEvery access to and change of patient data is written to a tamper-evident, hash-chained audit log that practices can review and export.
06AIClinical AI runs on Anthropic and OpenAI under executed BAAs. AI-proposed clinical actions wait for a clinician's approval and are logged like any other action.
07MCP connectionsClaude connects through OAuth with per-connection scopes, an activity log, and one-click revoke. Patient connections can't order or prescribe, and they send a message or book a visit only after the patient confirms it.
03 / Backups and recovery
The database can be restored to any point in the previous 7 days from encrypted AWS backups.
04 / No tracking
No advertising trackers or pixels. Patient data is never sold or shared with advertisers. Our marketing pages use cookieless, aggregate analytics. The app and patient data are never measured by third parties.
05 / Review