SECURITY AND TRUST

Member data is the reason this page exists. Here is how we protect it, and what is not finished.

AdherenceStar computes Star Ratings measures from a plan’s own claims, so it is built to hold protected health information. Each sentence below describes something the platform does, or says plainly that it is not done yet. Your security team will ask about every point; here they are first.

PAGE LAST REVIEWED: OCTOBER 2, 2026

Member data never reaches an AI model.

Every AI feature calls its model through one gateway. The gateway replaces member identifiers with tokens before anything leaves, and Google Cloud’s data-loss-prevention service inspects every request. If that inspection finds member data, or cannot reach a verdict, the call is refused and no model is called. Only the gateway’s own identity can reach a model, the gateway stores nothing, and attempts to get around it are tested on every change with the identifiers members actually have: names, dates of birth, Medicare numbers, member IDs, ZIP codes, street addresses and phone numbers, written the ways people type them.

The database walls every customer off.

Each organization’s records are separated by rules the database itself enforces, not by every query being written correctly. Which organization a person belongs to comes only from their verified sign-in, never from anything their browser sends. A test that tries to read across organizations runs on every change and fails the build if it ever succeeds.

Your files are encrypted under your own key.

Each organization’s uploaded files, nightly backups and computed results are encrypted with a Cloud KMS key that belongs to that organization alone, rotated every 90 days. On the standard shared tier, working records such as worklists and the audit trail sit in a shared database under a platform key; a dedicated tier with its own cloud project and database is designed for plans that require it. Every public surface is served over TLS only.

Stored in the United States, where you choose.

An organization picks one of six US locations for its files, backups, results and key: the US multi-region, which is the default, or one of five single regions. The product says in plain words what that choice does not move on the shared tier. AI requests, which carry no member data, are served from Google’s global endpoint.

Everyone signs in with a second factor.

Multi-factor sign-in is required for every user, with no per-user opt-out, and the server itself refuses a session that lacks a second factor. Sessions end 12 hours after sign-in. Deactivating a user ends their access on their next request. Single sign-on over SAML or OIDC is supported, with your identity provider’s groups mapped to roles.

People see what their job needs.

Five roles: admin, analyst, auditor, care manager and pharmacist. Care managers and pharmacists see the members on their own worklists. Auditors see member IDs, never names or contact details. Access can be limited to particular contracts. The table of which role sees which field is generated from the rules the platform enforces, so the two cannot drift apart.

Every look at member data is recorded.

Each read of member data, each administrative act and each refusal lands in an append-only audit trail that no user can edit. Admins and auditors read it in the product, and opening it is itself recorded. A member’s accounting of disclosures covers six years and exports as a spreadsheet, and right-of-access requests are tracked against HIPAA’s thirty days.

Nothing is read before it is scanned.

Every uploaded file is scanned for malware before anything opens it. A file that is infected, is an archive, or cannot be scanned is quarantined or refused, and each quarantine is recorded.

Logs carry no member data.

Application code writes its logs through an allowlist logger, so a member’s details cannot reach a log line by accident, and a test fails the build on any other way of logging.

Credentials are never stored with the code.

Secrets live only in Google Cloud Secret Manager, reached through keyless federation rather than stored keys. Every change, and the whole history weekly, is scanned for leaked secrets and vulnerable dependencies.

IF SOMETHING GOES WRONG

Planned before it is needed.

An incidentWe are your business associate: we notify you, and you notify members and regulators. We notify you as your BAA requires, within 72 hours when it is silent, and never later than HIPAA’s 60-day limit. A written review follows within 14 days.

An outagePlatform status is public at adherencestar.com/status. If we activate our contingency plan, you hear from us within 24 hours. While degraded, the platform refuses what it cannot do safely: no write happens without the audit trail.

BackupsNightly, into your organization’s own backup storage under your key, versioned and retention-locked for 90 days. Recovery targets are written per kind of data — for uploaded files, at most 15 minutes lost and restored within 4 hours.

LeavingAccess stops when offboarding starts. After the retention window in your contract, your data is deleted, your key is destroyed last so any remaining copy is unreadable, and you receive a certificate of destruction.

Our peopleEveryone with access completes HIPAA training before access is granted and every year after; completions are recorded and kept six years. Today that is one person, the founder.

WHAT IS NOT DONE YET

What we do not claim.

A trust page that lists only strengths is a sales page. These are open today, and we will tell you where each one stands whenever you ask.

Member dataNone yet. Until the first customer the platform holds only synthetic data, end to end — and that is enforced in code: an organization’s file intake stays closed until a signed business associate agreement is on file, and demo organizations refuse uploads outright.

Our BAAsNot yet executed with Google Cloud or Vercel. Both are signed together with the first customer’s agreement, before any member data arrives.

Penetration testNot yet performed. Engaging an external tester is a condition of our go-live checklist.

CertificationsNone. We hold no SOC 2 report, HITRUST or ISO 27001 certification. Our control matrix is mapped to the SOC 2 criteria, and we share it on request.

ExercisesOne incident drill, run on synthetic data in September 2026. A human tabletop exercise and a restore rehearsal against production are not yet held.

Code reviewWith one engineer, changes are not reviewed by a second person; automated checks gate every change. Recorded as an accepted risk until the first hire.

FOR YOUR SECURITY REVIEW

Your questionnaire, answered from the source.

We send an architecture summary, our control matrix with its disclosed gaps, and our subprocessor list — generated from the same documents the platform is checked against, not written for the occasion. Security questions and vulnerability reports go to hello@adherencestar.com.

Google CloudStorage, databases, analytics, AI models (Vertex AI) and data-loss prevention. BAA signed at the first customer.

VercelHosts the website and the application. BAA signed at the first customer. Stored data never lives on Vercel.

TwilioPlanned, for member text messages and calls. Not in use, and not before its BAA is signed.

See it on synthetic data.

A demo runs on a generated book of members: the same product, and no one’s real data.

Request a demo