Encryption at rest and in transit, key management, and what we can and cannot see.
The short version
All customer data is encrypted in transit and at rest, keys are managed rather than scattered, and there are specific, documented limits on what SuperHIPAA staff can see. The rest of this page fills in the detail a security reviewer needs — algorithms, key management, and the honest boundaries of what encryption does and does not protect against.
Encryption in transit
Every connection to the service — browser, API, and internal service-to-service traffic — is encrypted:
- External traffic uses TLS 1.2 or higher; older protocol versions and weak cipher suites are disabled.
- Certificates are issued and rotated automatically, so an expired certificate cannot silently downgrade a connection.
- Internal traffic between services crosses encrypted channels (TLS within our private AWS network segments), because “inside the network” is not a trust boundary we rely on.
Encryption at rest
- Primary datastores, file storage, and backups are encrypted at rest using AES-256.
- Backups are encrypted independently of production, so compromise of one does not imply compromise of the other.
- Uploaded evidence files — often the most sensitive material customers give us — are stored encrypted with the same discipline as structured data, not parked in a plain object bucket.
Key management
Encryption is only as strong as the key handling behind it, which is where most encryption stories quietly fall apart:
- Keys are generated and stored in a managed key service (AWS KMS), never in application code, configuration files, or repositories.
- Key access is separated from data access — the roles that can touch stored data are not the roles that can touch keys.
- Keys are rotated on a defined schedule (annually) and on demand if compromise is suspected.
- Key usage is logged, so unusual access patterns are detectable rather than invisible.
What we can and cannot see
Honesty about access matters more than a longer cipher list. SuperHIPAA is not an end-to-end encrypted product: our systems must process your data to run assessments, generate reports, and index evidence, which means decryption happens server-side under our control. What we constrain is human access:
- No employee has standing access to customer workspace contents.
- Support access to a workspace requires an explicit customer grant through an approval workflow, is time-limited, and is logged.
- Production access for engineers goes through SSO with enforced MFA and short-lived, role-based credentials, with approvals and audit trails.
If a vendor tells you their staff can never see your data while also offering to help you debug it, one of those statements is wrong. We would rather describe the real boundary precisely.
What we commit to
- All customer data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, including backups.
- Encryption keys live in AWS KMS, are rotated annually, and are never stored in code, configuration, or repositories.
- No SuperHIPAA employee has standing access to customer workspace contents; every access path is role-based, approved, time-limited, and logged.
Encryption and HIPAA
Encryption is an addressable specification under the Security Rule, not an optional one — “addressable” means you implement it or document why an alternative is reasonable, and for data of this sensitivity there is rarely a credible alternative. Encrypting ePHI to the standards in HHS guidance also matters for breach notification: properly encrypted data that is lost or stolen may not constitute a breach of unsecured PHI. We maintain our encryption to that standard so the safe harbour is available to our customers, while being clear that the determination in any real incident depends on the facts of that incident.
Documentation available on request
- SOC 2 Type II report (under NDA)
- Penetration test summary
- Business Associate Agreement
- Architecture and data flow diagram
- Completed CAIQ / SIG Lite
The architecture and data flow diagram shows where encryption boundaries sit in practice — which is usually the diagram security reviewers actually want, and the one most vendors make you ask for twice.
Questions
Security questions go to [email protected] and get a human answer within one business day. If your review needs specifics beyond this page — cipher suite lists, key hierarchy detail, or customer-managed key options — ask; the answer may be NDA-gated but it will not be evasive.