HIPAA Compliance

1. Overview & Commitment

TesseraVault is designed with the Health Insurance Portability and Accountability Act (HIPAA) in mind. While primarily a secure document collection platform, we recognize that our users may handle Protected Health Information (PHI) and have built our infrastructure accordingly. Our zero-knowledge architecture means that even in the unlikely event of a server-side breach, PHI remains encrypted and unreadable.

2. Administrative Safeguards

TesseraVault maintains the following administrative safeguards:

• Designated security personnel responsible for HIPAA compliance
• Documented information security policies and procedures
• Regular risk assessments and security audits
• Incident response procedures with defined escalation paths
• Workforce access controls limited to essential personnel
• Comprehensive audit logging of all system access and data operations

3. Physical Safeguards

TesseraVault leverages enterprise-grade infrastructure providers for all data storage and processing. Our subprocessors (detailed in Section 10) maintain SOC 2 Type II compliance and operate data centers with:

• 24/7 physical security monitoring and access controls
• Redundant power and environmental controls
• Secure media disposal procedures
• Geographic redundancy for disaster recovery

4. Technical Safeguards

TesseraVault implements multiple layers of technical protection:

• AES-256-GCM encryption for all documents, performed client-side before data reaches our servers
• RSA-4096 key pairs for secure key exchange between parties
• PBKDF2 with 600,000 iterations for passphrase-based key derivation
• TLS 1.3 for all data in transit
• Rate limiting on all endpoints to prevent abuse
• Brute-force detection with automatic account lockout
• Session management with configurable expiry and secure cookie attributes

5. Zero-Knowledge Architecture & PHI

TesseraVault's zero-knowledge architecture is the cornerstone of our HIPAA compliance strategy. Documents are encrypted in the user's browser using AES-256-GCM before being uploaded. The encryption key is itself encrypted with the recipient's RSA-4096 public key.

This means TesseraVault servers never have access to plaintext PHI. Even our engineering team cannot decrypt uploaded documents. In the event of a server-side breach, attackers would obtain only ciphertext that is computationally infeasible to decrypt without the user's private key and passphrase.

6. Breach Notification Process

In compliance with the HIPAA Breach Notification Rule (45 CFR 164.400-414), TesseraVault maintains an automated breach detection and notification system:

• Automated detection: Failed login attempts, bulk download patterns, rate limit abuse, and suspicious activity are automatically flagged as security incidents
• Real-time admin alerts: Critical and high-severity incidents trigger immediate email notifications to administrators
• 60-day notification deadline: Our system tracks the HIPAA-mandated 60-day notification window and automatically sends breach notification emails to affected individuals when the deadline approaches
• Manual notification: Administrators can trigger breach notifications at any time through the admin dashboard
• Incident lifecycle: All incidents are tracked through open, acknowledged, and resolved states with full audit trail

7. Business Associate Agreement

Organizations on the Enterprise plan that handle PHI through TesseraVault may require a Business Associate Agreement (BAA). TesseraVault is prepared to enter into BAAs with covered entities and their business associates.

To request a BAA, please contact us at [email protected].

8. Audit Controls

TesseraVault maintains comprehensive audit controls including:

• Immutable audit log recording all user actions, authentication events, document operations, and administrative actions
• Each audit entry captures timestamp, user ID, action type, resource details, and IP address
• Admin dashboard with filterable, searchable audit log viewer
• CSV export capability for compliance reporting (up to 10,000 records)
• Security incident tracking with severity classification and response workflow

9. Data Retention & Disposal

TesseraVault provides configurable data retention controls:

• Document request links can be configured with 7, 14, or 30-day expiration periods
• Expired request data is automatically purged from both the database and object storage after a 30-day grace period
• Users can manually mark requests as completed or cancelled at any time
• Account deletion permanently removes all user data, including uploaded documents from object storage
• Orphaned document records (failed uploads) are automatically detected and cleaned up

10. Subprocessors

TesseraVault uses the following subprocessors. Each handles data as described:

11. Contact

For HIPAA-related inquiries, BAA requests, or to report a security concern, please contact:

[email protected]