Controls you can check.
Healthcare data carries obligations that outlast any one vendor relationship. Below is what ArkCloud Health actually implements, and where in the system each control lives. Where a certification is in progress rather than held, this page says so.
HIPAA
Designed to supportThe technical safeguards described on this page are implemented to support a covered entity's or business associate's HIPAA obligations. A Business Associate Agreement is available.
SOC 2 Type II
Programme in progressAn audit programme is underway. The certification is not yet held, and we will not claim it until a report exists.
HITRUST CSF
Not heldControls are aligned to the framework. No certification is held and none is claimed.
Field-level PHI encryption
Protected health information is encrypted with AES-256-GCM at the field level, under a master key supplied by the environment rather than stored with the data.
lib/intake/security/encryption.ts
Encryption in transit
All traffic is served over TLS. A Content-Security-Policy restricts framing, form submission and object embedding, and every allowed origin is enumerated rather than wildcarded.
next.config.ts
Card data is never stored
Payment card details go directly to the payment processor and are never written to ArkCloud storage. The processor is the PCI-DSS Level 1 party; ArkCloud is not in the cardholder data environment.
lib/payment-processor.ts
Retention and archival
Configurable retention policies with archival to cold storage for long-term retention obligations, run as a scheduled job rather than by hand.
lib/cold-storage/glacier-archival.ts
Tenant isolation in the data layer
Every record is tenant-scoped and isolation is enforced by database row-level security, not only by application queries - so a missed WHERE clause returns nothing rather than another customer's data.
docs/security/RLS_DESIGN.md
Multi-factor authentication
TOTP-based MFA, enforced for administrator and super-administrator roles in production by middleware rather than left to a user preference.
lib/mfa/totp.ts
Single sign-on
SAML 2.0 for enterprise identity providers, plus OAuth via Google and Microsoft Entra ID with PKCE. Email-domain-to-tenant mapping controls which organization an SSO user joins.
lib/auth/saml-provider.ts
Sessions and lockout
Absolute session lifetime rather than a rolling idle window, HTTPOnly cookies, and account lockout after repeated failed sign-ins.
lib/auth/config.ts
Role-based access control
Roles and permissions are checked server-side on every request. Product entitlements are enforced at each product's entry point, so a URL cannot be typed into access.
lib/product-access.ts
Immutable audit trail
Security-relevant events are written to a write-once audit log. Sign-in success and failure, lockout and privilege elevation are always recorded.
app/actions/enterprise-security-advanced.ts
PHI access logging
Reads of protected health information are logged separately from ordinary application events, so a breach investigation does not have to reconstruct them.
lib/audit.ts
Structured telemetry
OpenTelemetry tracing and structured logging with sensitive-field redaction, so operational data can be inspected without exposing PHI.
instrumentation.ts
Rate limiting
Per-endpoint rate limits on authentication and other sensitive routes.
lib/rate-limit.ts
Reviewing ArkCloud Health?
Security questionnaires, architecture reviews and Business Associate Agreements go to the security team directly. We would rather answer a hard question than have you infer the answer from a badge.