Security Standards & Compliance

Certifications & Attestations

Cryptographic Audit Integrity

STFE's most distinctive security feature is the SHA-256 tamper-evident hash-sealing of every clinical evaluation record. This is not a standard feature of any other SNF or CAH software.

• Proof-of-Intent Hash (POI): At the moment of evaluation, a SHA-256 hash is computed over the patient state, the active clinical rule set, the facility thresholds, and the evaluation timestamp. This hash is stored immutably.
• Tamper evidence: Any modification to an audit record — even a single character — produces a different hash. This proves records have not been altered since the moment of the clinical decision.
• DON signature chain: The Director of Nursing's NPI is attached to the rule set sign-off. Each evaluation records which signed rule version ran.
• ADR defense: The signed audit record can be presented to CMS surveyors as evidence that the admission decision was made based on documented, consistent clinical criteria at a specific point in time.

Infrastructure Security

Access Controls

• Role-Based Access Control (RBAC): 5 distinct roles with strictly enforced permission boundaries. Users can only access data associated with their facility.
• Multi-Factor Authentication: Required for all administrative roles (FACILITY_ADMIN, OPERATOR_EXEC, SYSTEM_ADMIN).
• API Key Authentication: API access requires facility-specific API keys. Keys are SHA-256 hashed before storage — not reversible.
• Session Management: JWT tokens with short expiry. Refresh token rotation on every use. No persistent sessions stored server-side.
• Audit Logging: Every user action — login, evaluation, override, configuration change — is logged with timestamp, user ID, IP address, and action detail. Logs are immutable.

Application Security

• Dependency scanning: Automated scanning for known vulnerabilities in all dependencies (Python packages, npm packages) on every build.
• Input validation: All API inputs validated against strict Pydantic schemas. SQL injection and XSS prevention at the framework level.
• CORS policy: Strict origin allowlist. No wildcard CORS.
• Rate limiting: API rate limiting on all endpoints to prevent abuse and credential stuffing.
• Penetration testing: Annual third-party penetration test. Critical findings remediated within 72 hours; high findings within 14 days.

Business Continuity

• Uptime SLA: 99.9% monthly uptime commitment (planned maintenance excluded).
• Database backups: Automated daily snapshots retained for 30 days. Point-in-time recovery available.
• Multi-AZ deployment: Production infrastructure deployed across multiple AWS Availability Zones.
• Incident response: On-call engineering coverage. Defined escalation paths. Status page at status.stfe.io.

Employee Security

• Background verification for all employees with system access
• Annual HIPAA and security awareness training
• Signed confidentiality agreements covering PHI and trade secrets
• Production access is role-based, logged, and subject to quarterly access review
• Engineering team does not have standing access to production PHI — access requires approval and creates an audit trail

Request Security Documentation

The following security documents are available to customers and prospective customers under NDA:

• SOC 2 Type II report (most recent)
• Penetration test executive summary
• Subprocessor list with data categories
• Data Processing Agreement (DPA)
• Business Continuity Plan summary

Contact security@stfe.io to request security documentation.