Protexa is built for healthcare. Security is not an afterthought bolted onto a generic GRC platform — every control here was designed under HIPAA, mapped to specific Security Rule sections, and verifiable on request.
The controls that matter — encryption, identity, audit, isolation — run continuously. Not "documented as a policy" — actually enforced in code. The panel on the right is the live state, not a screenshot.
Protexa
AES-256 TLS 1.3 Enforced · admin + officer SAML 2.0 · Okta · Azure AD · Google Forever · immutable, append-only Per-customer · row-level security Every customer organization runs in a logically isolated namespace enforced at the database row level. There is no shared data across tenants. A query mis-attributed to the wrong organization fails closed — rejected before the database touches a single row.
The HIPAA minimum-necessary principle applied at every step, not just where auditors check. Ambient transcripts are processed in memory and discarded after extraction; only the structured OASIS items + clinician attestation persist.
Cloud infrastructure (Supabase, Vercel) operates under signed BAA. Subprocessors handle compute and storage only — they never receive PHI in plain text and have no application-level access. Full subprocessor list available on request.
§164.308 administrative safeguards · §164.312 technical safeguards · §164.314 organizational requirements. Each control mapped to specific platform features and audit-log events. The mapping is itself an artifact we provide during due diligence.
Healthcare buyers don't trust vendors who promise nothing will go wrong. They trust vendors who can show what happens when it does.
Continuous monitoring across application, infrastructure, and access layers. Anomaly detection on access patterns, failed auth attempts, and configuration drift.
Breach Responder agent classifies severity and scope automatically. Material incidents (PHI exposure, integrity loss, availability >4h) escalate to a 24-hour customer notification SLA — well inside the §164.408 60-day ceiling.
Immutable audit log provides a forensic timeline back to first event. Bundle assembled automatically: affected records, timeline, root cause, remediation steps, breach notification draft.
Public disclosure for material incidents posted within the customer notification window. Pattern modeled on Drata's incident transparency — say what happened, what we did, what we changed.
Your VRA process probably has a checklist. Most of what you need is on this list. What's not — tell us, and we'll either send it, sign it, or tell you honestly when it'll be ready.
Or email [email protected] directly with your security questionnaire attached.