Security Policy

Status: Phase 30 G4.T3 deliverable — public-facing security discipline statement. Companion docs: docs/trust-center/index.md · docs/compliance/soc-2-tsc-2017-control-mapping.md.

Authentication + Access Control

• All employee access to production systems requires hardware-key MFA.
• Access reviews are conducted monthly (see ADR 0048 §3 layer 3 + App\Jobs\Compliance\Soc2\ExportMonthlyAccessReviewJob).
• Tenant isolation enforced via Postgres Row-Level Security (ADR 0003) + TenantBoundary helper (ADR 0008).

Encryption

• TLS 1.2+ for all data in transit.
• PHI + PII encrypted at rest with rotating keys (ADR 0015).
• AES-256-GCM for application-layer encryption of sensitive fields.

Network Security

• Cloudflare WAF + Rate Limiting + Bot Fight Mode at the edge (ADR 0017).
• Origin only reachable via Cloudflare (origin IP not exposed).
• Embedded widget security per ADR 0031 (SRI + Shadow DOM + CSP + postMessage hardening).

Vulnerability Management

• Weekly automated scans (Composer + npm audit + Dependabot per App\Jobs\Compliance\Soc2\ArchiveVulnerabilityScanJob).
• Critical vulnerabilities triaged within 24 hours.
• Patch SLAs: Critical 24h, High 7 days, Medium 30 days, Low best-effort.

Personnel Security

• Background checks for all engineering hires.
• Annual security awareness training.
• HRIS onboarding/offboarding tracked (App\Jobs\Compliance\Soc2\RecordHrisOnboardingEvidenceJob).
• Access removal within 24 hours of termination.

Source ADRs

ADR 0003 (RLS) · ADR 0008 (TenantBoundary) · ADR 0012 (PHIGuard fail-closed) · ADR 0013 (tokenized portal session) · ADR 0015 (PII / medical encryption) · ADR 0017 (rate limiting) · ADR 0020 (Sentry PII / PHI scrubbing) · ADR 0031 (widget security).