Skip to main content
OutsideINsights by CodePause — continuous care intelligence platform

Security at OutsideINsights

Post-quantum encryption, database-enforced isolation, and an append-only audit trail — security built past today's requirements, ready for tomorrow's.

Our Security Mission

Security isn't an afterthought at OutsideINsights — it's the foundation of everything we build. We handle Protected Health Information (PHI), and the platform was architected from day one so that the strongest protections are structural: enforced by cryptography and by the database itself, not by application habits.

This page describes how that works in plain terms. For architecture-level detail, technical evaluators can go deeper on our IT Administrators page.

What Sets Our Posture Apart

Three protections most platforms in this space don't have:

Post-Quantum Message Encryption

Every message is sealed with a fresh key under AES-256-GCM, wrapped for each recipient with a hybrid of X25519 and ML-KEM-1024 — the NIST-standardized post-quantum algorithm (FIPS 203). Escrow keys exist at rest only as KMS-wrapped blobs, and key material is zeroized after use. Data encrypted today stays protected against the cryptography of tomorrow.

Database-Enforced Tenant Isolation

Row-Level Security is enabled and enforced on roughly one hundred PHI tables. Tenant identity is resolved inside the database from the authenticated session — never trusted from a client token — so the database itself refuses cross-tenant reads. The isolation model is exercised by a penetration test that ships with the codebase.

Append-Only Audit Ledger

Access, changes, and consent decisions are recorded to an append-only audit history with identity-stamped, timestamped entries. Records are added, never rewritten — built to satisfy the HIPAA Security Rule's audit requirements and to support forensic review.

HIPAA Compliance

Our infrastructure and practices comply with the HIPAA Security and Privacy Rules for handling Protected Health Information. The platform runs on HIPAA-eligible cloud infrastructure operated under Business Associate Agreements, with services deployed access-gated by identity — not open to the internet by default.

Encryption

In Transit

All traffic between users and our servers moves over modern TLS with HTTP Strict Transport Security (HSTS) enforced on every response, preventing downgrade attacks. Message payloads additionally carry the post-quantum envelope described above — encryption on top of transport encryption.

At Rest

Data stored in our systems is encrypted at rest with AES-256, including backups. Encryption keys are held in cloud key-management custody (KMS), separate from the data they protect.

Identity, Access & Sessions

  • Enterprise identity: authentication runs on enterprise-grade identity infrastructure supporting SAML, OIDC, and Active Directory federation, so organizations keep their existing identity workflows.
  • Hardened token handling: token validation uses a strict algorithm allowlist — no downgrade or algorithm-confusion paths — and sessions are stored only as keyed hashes.
  • Server-side revocation: session revocation is checked on every request, so terminated access ends immediately — not when a token happens to expire.
  • Role-based access: granular, least-privilege permissions; third-party observers can only access data for patients who explicitly authorize them, and patients can revoke that access at any time.
  • Account protection: industry-standard password hashing (bcrypt), enumeration-safe reset flows, and enforced CSRF protection.

Platform & Supply-Chain Hygiene

  • No secrets in code: secrets are injected from a managed secret store at deploy time, never committed to the repository — verified by automated secret scanning in CI, with runtime configured to fail closed.
  • Dependency discipline: third-party dependencies are triaged and documented, with zero production-reachable known vulnerabilities as of our most recent review.
  • Ingress hygiene: parameterized queries throughout, distributed rate limiting, locked-down CORS, and security headers on every response.
  • Least privilege: internal services deploy identity-gated, and gateway services connect to the database under least-privilege roles.
  • Backups & continuity: continuous automated backups with point-in-time recovery, encrypted with the same standards as production data.

HIPAA Business Associate Agreements (BAA)

For healthcare providers who are HIPAA-covered entities, CodePause acts as a Business Associate. We execute Business Associate Agreements that define permitted uses of PHI, the administrative, physical, and technical safeguards we maintain, subcontractor obligations, breach-notification duties, access rights, and termination terms. Vendors that handle PHI on our behalf operate under BAAs of their own.

BAAs are executed as part of customer onboarding. To request one, contact legal@codepause.com.

Workforce Security

Team access follows strict need-to-know policies with immediate revocation on role change or departure. Everyone who touches PHI completes HIPAA and security training, and development, staging, and production environments are separated. Production access is logged to the same append-only trail as everything else.

Incident Response & Breach Notification

We maintain documented procedures for detecting, containing, and recovering from security incidents, with a designated response team and defined escalation paths. In the event of a breach involving PHI, we will:

  • Notify affected customers without unreasonable delay and no later than 60 days after discovery
  • Provide information about the nature of the breach, the PHI involved, and the steps being taken
  • Comply with all HIPAA breach-notification requirements and support customers in their own notification obligations
  • Conduct post-incident analysis and apply what we learn

Data Retention & Deletion

  • PHI: retained for 6 years from creation or last use (HIPAA requirement)
  • Billing records: retained for 7 years (IRS requirement)
  • Audit logs: retained for a minimum of 6 years, stored with the same encryption and access controls as production data
  • Your data leaves with you: upon request, customer data can be exported or securely deleted in accordance with applicable regulations — standards-based and export-friendly by design

Responsible Disclosure

We welcome responsible disclosure of security vulnerabilities. Report findings to security@codepause.com — we commit to acknowledging reports within 48 hours and working to resolve verified issues promptly. We ask that you avoid accessing PHI, degrade no service, and give us reasonable time to remediate before public disclosure.

Questions About Our Security?

We believe in transparency about how we protect your data.

See also our Privacy Policy.

← Back to Home