Security & Compliance

Our Approach

PsyFi Technologies (DBA; formerly Oaken Cloud Technologies) builds clinical-documentation tools for behavioral health. We implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 CFR §§164.302–318), and we operate as a Business Associate under §164.502(e) when a covered entity signs our BAA.

This page is descriptive, not legal advice. HIPAA compliance is collaborative: we are responsible for our infrastructure and software controls; your organization is responsible for workforce training, device security, access policies, and breach-notification procedures inside your practice.

Infrastructure

PsyFiGPT runs entirely on Amazon Web Services in the us-east-1 (N. Virginia) region. The architecture is three-tier with strict subnet separation:

• • Public tier — only the Application Load Balancer is internet-facing. The ALB has enable_deletion_protection=true and runs in defensive desync-mitigation mode.
• • App tier — application servers run in private subnets with no public IPs. SSH is disabled; operator access is over AWS Systems Manager Session Manager, which is itself logged.
• • Database tier — RDS PostgreSQL 16.4 multi-AZ, in private subnets reachable only by the app security group.

Egress to AWS services (SSM, Secrets Manager, KMS, CloudWatch Logs, S3, SQS) traverses VPC interface and gateway endpoints rather than the public internet, reducing the network attack surface and avoiding internet-edge dependencies for backend infrastructure.

Encryption

• • In transit: ALB TLS termination using the ELBSecurityPolicy-TLS13-1-2-2021-06 policy. TLS 1.3 is negotiated where the client supports it; TLS 1.2 is the minimum. Port-80 HTTP is 301-redirected to HTTPS at the load balancer.
• • At rest: RDS storage uses storage_encrypted=true (AES-256 via AWS KMS). Performance Insights data is also KMS-encrypted. EBS volumes attached to application instances use AWS KMS encryption.
• • Secrets: Database credentials and application secrets live in AWS Secrets Manager (/psyfigpt/prod/db, etc.) and are pulled at boot — never committed to source.
• • Backups: RDS automated snapshots retained for 7 days; manual snapshots retained per business need; backups inherit storage encryption.
• • Multi-AZ: The RDS instance runs multi_az=true with deletion_protection=true, providing synchronous standby replication and automatic failover.

PHI De-identification (Microsoft Presidio)

PsyFiGPT runs Microsoft Presidio locally, in-process, before any text is sent to our LLM subprocessor. Tenant administrators can require de-identification for their organization. No de-identification data leaves our infrastructure — Presidio is a Python library, not a third-party service.

1. You submit a message or session note in the PsyFiGPT UI.
2. The text enters our app server in AWS us-east-1.
3. Presidio's AnalyzerEngine runs a spaCy NLP model + pattern recognizers to detect PHI/PII entities: PERSON, LOCATION, DATE_TIME, EMAIL_ADDRESS, PHONE_NUMBER, US_SSN, US_DRIVER_LICENSE, and others.
4. HIPAA Safe Harbor scoping: ages < 90 are NOT redacted; relative temporal phrases ("last week", "in childhood", "Friday") are NOT redacted; only specific identifying dates (DOB, full calendar dates, month-year) are redacted.
5. An explicit regex layer runs as a safety net for high-confidence patterns Presidio can miss: medical record numbers (MRN, chart number, patient ID), account/policy/claim numbers, labeled dates of birth, street addresses, and email/phone/SSN patterns.
6. Detected spans are replaced with the masking character ● (Unicode U+25CF), preserving structure so the LLM still understands sentence shape.
7. The redacted text is sent to Azure OpenAI for inference. The original (un-redacted) text is stored in your tenant database in RDS, never sent to the model.

If Presidio's spaCy model is unavailable for any reason, the engine degrades to NoOp + explicit regex (logged, never silent). The PHI pattern fallbacks always run regardless of engine choice. AWS Comprehend Medical is configurable as an alternative engine.

Subprocessor List

A subprocessor is any third party that processes your PHI on our behalf. We keep this list short by design — fewer subprocessors means a smaller surface area and a simpler BAA chain. We notify customers of material additions or changes prior to onboarding new PHI subprocessors.

Not a subprocessor: Microsoft Presidio is the de-identification library we run locally. It is open-source software (MIT-licensed) executed inside our application process. No data leaves our environment for de-identification.

Application & Identity

• • Identity provider: Amazon Cognito is the sole authentication backend. Native email and password, Sign in with Google, and Sign in with Apple all flow through Cognito.
• • Two-factor authentication: App-based TOTP (RFC 6238) with single-use recovery codes for account recovery. Users enroll and verify via /settings/security/2fa.
• • Role-based access: App-level roles (ADMIN, USER) and team-level roles (Admin, Super Admin, User). Admin-only endpoints reject non-admin sessions and emit an UNAUTHORIZED_ACCESS audit event.
• • Multi-tenant isolation: Application queries scope to the requesting user's company; database constraints enforce ownership invariants.
• • Session security: Cookies are Secure, HttpOnly, and SameSite-scoped. Session expiration is enforced server-side and logged.
• • CSRF & rate limiting: Flask-WTF CSRF tokens on all state-changing endpoints; per-route rate limits with Redis-backed counters; violations emit audit events.
• • HTTP security headers: HSTS (preload-eligible), X-Frame-Options: DENY, strict Referrer-Policy, and a Content Security Policy restricting script and connect origins.

Audit Log

PsyFiGPT writes to a dedicated, append-only audit_log table. The table is designed for the 6-year retention horizon required by HIPAA §164.316(b)(2)(i). Each entry captures the actor (user ID + email preserved even if the user is later deleted), target resource, IP address, user agent, correlation ID, timestamp (UTC), and structured metadata. The 40+ tracked event types span:

Application request logs (separate from the audit log) are emitted as structured JSON via structlog and shipped to CloudWatch with a 30-day retention policy. PHI is redacted from these logs by an in-process middleware before they leave the application server.

Incident Response & Breach Notification

PsyFi Technologies follows the HIPAA Breach Notification Rule (45 CFR §§164.400–414). If we discover a breach of unsecured PHI affecting your tenant, we will notify your designated contact without unreasonable delay, and in no case later than 30 days from discovery — a stricter contractual commitment than HIPAA's statutory 60-day maximum for business associates — with the information you need to fulfill your downstream notification obligations: the categories of PHI involved, the date range of exposure, what we know about how it occurred, what we have done to mitigate, and what steps you can take.

Detection sources include CloudWatch alarms on application error rates and latency, the audit_log security events stream, and Sentry alerts on uncaught exceptions (with PHI redacted from payloads). On-call escalation is documented in our internal runbook, available under NDA.

Data Retention, Portability & Deletion

• • Export — users can export their chats and reports as CSV, DOCX, or PDF before deletion.
• • Account deletion — a first-class workflow that clears chat history, disables 2FA secrets and recovery codes, and removes PII fields from the user row.
• • Audit retention — the audit-log entry recording the deletion is preserved (actor email retained for traceability), because HIPAA requires audit immutability.
• • Backup retention — RDS automated backups roll off after 7 days; deleted data is no longer recoverable after that window.
• • Subprocessor data — Stripe billing records and Sentry error events follow each subprocessor's retention defaults.

Business Associate Agreement (BAA)

A signed Business Associate Agreement is included with every paid plan at no additional cost. The BAA is incorporated into our Terms of Service and is executed when you accept the Terms at signup — no separate sales call, no waiting period. Covered entities and their business associates can begin using PHI features in PsyFiGPT immediately.

A public summary of the BAA's commitments — parties, permitted uses, safeguards, breach notice, and subcontractor binding — lives on the BAA page. Counter-signed PDF copies are available on request for compliance programs that require one on file; we typically return an executed PDF within two business days.

Frequently Asked Questions

These answers are also published as FAQPage structured data on this page for AI search engines.

At a Glance

• • AWS us-east-1, three-tier VPC
• • TLS 1.2+/1.3 (ALB)
• • AES-256 at rest (KMS)
• • Cognito + Google/Apple SSO
• • TOTP 2FA + recovery codes
• • Microsoft Presidio (local)
• • Azure OpenAI (Microsoft BAA)
• • Immutable audit_log table
• • BAA included on every paid plan

Jump to

• Infrastructure
• Encryption
• PHI De-identification
• Subprocessor List
• Application & Identity
• Audit Log
• Incident Response
• Data Retention
• BAA
• FAQ