ComplyRer
Security
Effective September 14, 2026 · Last updated September 14, 2026
ComplyRer is built for care-agency operations: tenant isolation, role-aware access, private document storage, and an audit trail of privileged actions. This page describes controls that exist in the hosted product and the limits of those controls. It is not a certification package, a HIPAA declaration, or a penetration-test report.
HIPAA readiness
ComplyRer is built with HIPAA-aligned security practices and supports your HIPAA readiness. These technical safeguards are implemented in the hosted product today:
- Access control. Unique user credentials; role-based permissions scoped to assigned homes and people; deny-by-default row-level security, so an agency only ever sees its own records.
- Audit controls. Access to individual records is written to a PHI access log — actor, action, IP address, device — automatically at the database level. Corrections append to history; they never silently rewrite it.
- Re-authentication. Sensitive actions such as signing require password re-entry, verified server-side, with a short grace window for a signing session.
- Transmission security. Served over HTTPS. Uploaded documents are hashed and kept in private, agency-scoped storage — never in a public folder.
- Human review. Extracted plan details stay drafts until an authorized reviewer activates them. Signatures and delegations are named actions, not a generic checkbox.
What remains before real PHI goes in: signed Business Associate Agreements with our subprocessors (Supabase, Vercel, Resend), plus each agency's own risk assessment, policies, and workforce training. This section is a readiness statement — not a claim of HIPAA compliance, and not a certification. No vendor can truthfully claim to be "HIPAA certified": HHS does not certify products.
What we will not claim
- We are not HIPAA-certified and we do not state that the product is “HIPAA compliant” until a Business Associate Agreement, the safeguards below, and the agency’s procedures are in place.
- We do not advertise SOC 2, HITRUST, FedRAMP, or similar reports on this site unless a dated report is actually issued and linked.
- Readiness percentages in the product are a view of recorded work, not a guarantee of survey outcome.
Controls in the hosted product
- Transport. The marketing site and application are served over HTTPS.
- Tenant isolation. Agency records carry an agency identifier. Postgres row-level security is deny-by-default. Application APIs resolve the caller’s membership; they must not trust a client-supplied agency id as authorization.
- Access control. Roles (including administrator, house manager, nurse, DSP, and platform operator) combine with site and assignment scope. Staff should see only the homes and people they are assigned to.
- Authentication. Provider code, username, and password. New administrators must change a temporary password. Pending agencies cannot open care records until activated.
- Documents. Uploaded source files are hashed and stored in a private bucket using agency-scoped paths. They are not placed in a public CDN folder.
- Audit. Sensitive events are written to an append-only store. Corrections append; they do not silently rewrite history.
- Human review. Extracted plan items stay drafts until an authorized reviewer activates them. Signatures and delegations are named actions, not a generic checkbox.
Infrastructure processors
Production hosting runs on Vercel. Hosted authentication, database, and private storage run on Supabase. We do not send workspace contents to a public generative-AI provider unless an agency enables that pipeline and the contractual terms for that provider are acceptable to the agency.
Customer responsibilities
- Assign least-privilege roles and keep site rosters current.
- Do not share passwords or leave a signed-in session on a shared workstation.
- Keep real protected records out of demo and unverified environments.
- Export and retain records according to the agency’s own retention schedule; ComplyRer is not the agency’s sole legal archive unless a contract says so.
- Complete a BAA (or equivalent) before placing PHI in the workspace.
Incidents
If we confirm a security incident that affects your agency’s data, we will notify the agency administrator at the email we have on file and follow applicable law. Report suspected vulnerabilities or incidents to security@complyrer.com. Please do not attach real PHI to that email.
Work still in front of us
Before ComplyRer should be used as a system of record for real sensitive data, we still expect: MFA for privileged users, a completed security review, contractual BAAs where required, verified backup restoration, and malware handling on inbound files. Those items are product and operations work—not marketing claims.