Controls you can check.
Healthcare data carries obligations that outlast any one vendor relationship. Below is what ArkCloud Health actually implements, and where in the system each control lives.No security certification is held today, and this page says so.
HIPAA
Designed to supportThe technical safeguards described on this page are implemented to support a covered entity's or business associate's HIPAA obligations. A Business Associate Agreement is agreed with each customer during contracting.
SOC 2 Type II
Not heldNo SOC 2 report is held, and no audit has been engaged yet. We will not claim one until a report exists.
HITRUST CSF
Not heldNo HITRUST certification is held and no HITRUST assessment has been done. We keep an internal reference map of our controls against HITRUST CSF control references to find gaps; it is not an assessment.
Field-level PHI encryption
Designated PHI fields - clinical narrative and sensitive identifiers - are encrypted with AES-256-GCM at the field level, under a key supplied by the server environment rather than stored with the data. Fields left in clear, such as record identifiers and coded values, are each classified with a recorded reason. The database volume itself is not encrypted.
lib/encryption/phi-policy.ts
Encryption in transit
Public traffic is served over TLS 1.2 or later, plain HTTP is redirected, and HSTS is set. The application is reached from the edge through an encrypted tunnel. A Content-Security-Policy restricts framing, form submission and object embedding, and every allowed origin is enumerated rather than wildcarded.
next.config.ts
Card data is never stored
Payment card details go directly to the payment processor and are never written to ArkCloud storage. The processor is the PCI-DSS Level 1 party; ArkCloud is not in the cardholder data environment.
lib/payment-processor.ts
Retention and archival
Retention policies are configurable, and archival to cold storage is built as a scheduled job. The current deployment has no cold-storage destination configured, so archival is not running yet.
lib/cold-storage/glacier-archival.ts
Tenant isolation in the data layer
Every record is tenant-scoped and isolation is enforced by database row-level security, not only by application queries - so a missed WHERE clause returns nothing rather than another customer's data.
docs/security/RLS_DESIGN.md
Multi-factor authentication
TOTP-based MFA, enforced for administrator roles in production by middleware rather than left to a user preference. An organization can also require it for every user; that setting is read at sign-in, so it applies from each user's next sign-in. Other roles can enrol, and once enrolled are challenged on every session.
lib/mfa/totp.ts, lib/auth/mfa-gate.ts
Single sign-on
Google sign-in over OIDC with PKCE. A new SSO user is admitted to an organization only if their email domain is one of its verified domains; otherwise an administrator creates the user first. Microsoft Entra ID sign-in is written but not switched on, and SAML is refused outright until assertion signatures can be verified.
lib/auth/config.ts, lib/auth/saml-availability.ts
Sessions and lockout
Sessions end after an absolute 8 hours (30 days only when the user opts in to staying signed in), not a rolling idle window. HTTPOnly cookies. Ten failed sign-ins lock the account for 15 minutes.
lib/auth/config.ts
Role-based access control
Roles and permissions are checked server-side on every request. Product entitlements are enforced at each product's entry point, so a URL cannot be typed into access. Cross-tenant operator access requires an explicit allowlist that is empty by default.
lib/product-access.ts
Tamper-evident, append-only audit trail
Security-relevant events are written to an append-only audit log: the application's database role can add rows but cannot update or delete them, and each entry is chained to the one before it so a deleted, re-ordered or edited entry shows up in an integrity check (edits are detectable for entries written from 2 October 2026; earlier entries are checked for deletion and re-ordering only). Sign-in success and failure and account lockout are recorded in a separate audit-event table.
lib/audit/immutable-audit-log.ts; prisma/migrations/20261001130000_audit_append_only
PHI access logging
Every screen that opens a patient's clinical or billing record is logged separately from ordinary application events, with who, when, which screen and from which address, and an automated check fails any release that adds a record screen without it. Administrators review the log in the application, by patient or by person, and the application cannot edit or delete an entry. Browser-built CSV exports and search results are not logged row by row.
lib/phi-access-log.ts; tests/security/phi-view-logging-coverage.test.ts
Structured telemetry
Structured logging with sensitive-field redaction, so operational data can be inspected without exposing PHI. OpenTelemetry tracing is built in but exports nothing until a collector is configured, and none is today.
lib/logger.ts, instrumentation.ts
Rate limiting
Per-endpoint rate limits on authentication and other sensitive routes.
lib/rate-limit.ts
Reviewing ArkCloud Health?
Security questionnaires, architecture reviews and Business Associate Agreements go to the security team directly. We would rather answer a hard question than have you infer the answer from a badge.