Security
Honest about what ships, honest about what does not.
What ships today, separated from what is in build and what is planned. SOC 2 and HIPAA are in progress. We do not back-date a badge we have not earned.
Production controls
6 shipped
PHI gates, RLS, audit chain, encryption, and crisis routing.
Compliance posture
In progress
SOC 2 and HIPAA are explicitly not claimed until complete.
Current boundary
Decision support
Clinician-reviewed support, not diagnosis or emergency care.
In production today
What we ship right now.
No real PHI in dev
Real PHI is blocked at every layer until evidence, vendor agreements, and clinical governance are signed off. CI fails the build if PHI-shaped strings reach the client bundle.
Service-role key is server-only
The Supabase service-role key never reaches the client. The client imports only the anon key, which respects row-level security.
RLS on every table
Every public.* table has row-level security enabled with no policies. Anon reads return zero rows. Service-role is the only writer.
Append-only audit chain
Every state-changing action appends a row hashed with SHA-256 of the prior entry. The chain is re-walked on hydrate. The server refuses to start if any link breaks.
Encryption at rest + in transit
Supabase encrypts at rest with AES-256. All API traffic is HTTPS. Push tokens register through Expo's hosted HTTPS endpoint. We never store APNs or FCM credentials.
Multi-layer crisis path
PHQ-9 item-9 escalation is synchronous and surfaces 988 and 911 as plain text. The system prompt and a post-generation filter both block any agent attempt to argue against calling.
On the path
What is in active work.
SOC 2 Type 1 audit
Starting Q3 2026 with Vanta or Drata. Type 2 follows in 2027. We publish the auditor letter and trust-service criteria scope when complete.
HIPAA BAA
BAAs with Supabase, OpenRouter, Groq, Expo, and Vercel land once SOC 2 Type 1 is in hand. An internal register already tracks every PHI touchpoint.
Penetration test report
Third-party black-box pentest after SOC 2 Type 1. Summary letter published, full report under NDA.
SSO (SAML / OIDC)
Okta, Auth0, Google Workspace, and Microsoft Entra for Enterprise. Sequenced after the BAA.
Bias + safety eval framework
Classifier accuracy and adversarial-prompt pass-rate published per release. Modeled on the Wysa and Woebot playbooks.
Patient data-export
Patient-initiated download of every reflection, scale capture, and audit row tied to their identity. Required under California and EU rules.
Disclosure
Found a security issue?
Email support@humyn.studio, subject "Nyra security disclosure." We acknowledge within 72 hours and coordinate disclosure. No bounty program yet.