Interpolgar Security and compliance
We tell it as it is: Interpolgar Nexus is designed to support HIPAA and SOC 2 security requirements, but it does not yet have an independent audit or certification. This page shows what is done, what is in preparation, and how we work in the meantime.
How we work with pilot customers today
- Pilots use synthetic or de-identified data. We do not process identifiable health information (PHI) until a Business Associate Agreement is signed, a risk assessment is done and an independent penetration test is completed.
- When PHI is processed, a Business Associate Agreement (BAA) will be signed and the platform hosted on a cloud that also signs one.
- We answer customer security questionnaires with evidence from the code and the architecture.
Status by control
| Control | What we do | Status |
|---|---|---|
| Access control (HIPAA §164.312(a)) | Unique users, role-based permissions (least privilege), IP allow-lists, 15-minute sessions with rotating refresh and lockout after failed attempts. | Implemented |
| Authentication (§164.312(d)) | Hashed passwords, two-factor (TOTP) that insurers can require, single-use recovery codes. | Implemented |
| Audit controls (§164.312(b)) | Action log with a verifiable hash chain; alerts on suspicious behavior. | Implemented |
| Integrity (§164.312(c)) | Tamper detection through the hash chain; strict input validation. | Implemented |
| Encryption in transit (§164.312(e)) | HTTPS required in production; signed (HMAC) webhooks with SSRF protection. | Implemented |
| Encryption of sensitive data | Sensitive fields use AES-256-GCM with a per-insurer key and key rotation; encrypted backups. | Implemented |
| Isolation between customers | Every query is limited to the user’s insurer. Row-level isolation in PostgreSQL: part of the production migration. | In preparation |
| Disk and database encryption in production | Configured at deployment with managed keys (KMS). | Via cloud provider |
| Physical and data-center security | Provided by the cloud vendor under a BAA. | Via cloud provider |
| Risk assessment and written policies | Policy documentation, contingency plan and incident response. | In preparation |
| Workforce training | Security and privacy awareness program. | In preparation |
| Independent penetration test | Hire an external firm and fix findings before processing PHI. | In preparation |
| SOC 2 report (Type I, then Type II) | We will start readiness; Type II requires months of operating evidence. | Not yet |
HIPAA does not issue “certifications”: it is a law you comply with and demonstrate. Our alignment does not replace a customer’s own compliance assessment. For security questions write to info@interpolgarnexus.com.