AWS BAA
Executed
Trust & security center
The safeguards behind a compliant fulfillment rail.
NeoLife carries prescriptions from clinic to pharmacy without turning the storefront into a health record. This page is an honest account of how we protect patient data — our HIPAA posture, the AWS controls we run, how we handle data, and every subprocessor in the path.
Encryption
AES-256 · per-tenant DEK
PHI in storefront
None — gated egress
SOC 2 Type II
In progress
01
HIPAA posture
Three things carry the weight of our HIPAA program: an agreement with our cloud, keys that isolate each tenant, and a gate that keeps protected data off the surfaces that shouldn't see it.
A Business Associate Agreement with AWS
PHI-bearing infrastructure runs on AWS under an executed Business Associate Addendum. Only HIPAA-eligible AWS services carry regulated data, and the BAA is available to customers on request.
Per-tenant data-encryption keys
Every tenant's data is encrypted under its own data-encryption key. Keys are isolated per customer, so a single tenant's data can be cryptographically retired — crypto-shredded — on deletion rather than left behind a soft-delete flag.
A PHI-egress gate on the rail
The storefront never holds protected health information. Orders route through the pharmacy of record and the rail carries references, not diagnoses. The PHI firewall fails closed: data that isn't cleared to leave a boundary does not leave it.
No PHI in the storefront. The commercial surface handles catalog, checkout, and references only. Prescriptions and clinical data live with the pharmacy of record — the rail moves order references between systems, not diagnoses.
02
Infrastructure security
The AWS estate is hardened in version-controlled Terraform. Each control below maps to a real module in our infrastructure — not a roadmap item.
AWS KMS
Managed key custody
Customer-managed keys with rotation; envelope encryption for data at rest across the estate.
CloudTrail
Immutable audit trail
Every call to the AWS control plane is logged to a tamper-evident trail for forensics and review.
GuardDuty
Threat detection
Continuous, ML-driven monitoring of account, network, and data-access activity for anomalies.
AWS Config
Configuration drift
Records resource configuration over time and evaluates it against security baselines continuously.
Macie
Sensitive-data discovery
Automated discovery and classification of sensitive data held in object storage.
Security Hub
Posture aggregation
One pane aggregating findings and benchmarking the account against CIS and AWS standards.
AWS WAF
Edge filtering
Managed rule groups filter malicious traffic at the load balancer before it reaches application code.
VPC endpoints
Private connectivity
Traffic to AWS services stays on the private network — it never traverses the public internet.
03
Data handling
How data moves, who can reach it, and how that access is recorded. The rules are enforced in code and default to denial.
A PHI firewall between surfaces
Public and commercial surfaces are architecturally separated from any surface that can touch protected data. The boundary is enforced in code, not by convention, and it fails closed when a control cannot be verified.
Least-privilege, role-scoped access
Access is scoped by role with a hard boundary between customer scopes and operator scopes — a customer credential can never escalate into an operator scope. Non-production environments sit behind an SSO allowlist.
Append-only audit logging
Actions on sensitive surfaces are recorded to an append-only activity log. The record of who did what, and when, is written for review and cannot be silently rewritten.
04
Subprocessors
The third parties in the path of a NeoLife order, and what each can see. The full register — with the specific data shared and where it is processed — is published separately.
| Subprocessor | Purpose | Data shared |
|---|---|---|
| Amazon Web Services | Cloud compute, storage, managed data services | PHI · under BAA |
| Cloudflare | DNS, CDN, WAF, and access control | |
| Stripe | Payment processing and billing | |
| LifeFile / Empower | Pharmacy of record — order fulfillment | PHI · pharmacy |
The register lists every subprocessor, its purpose, the data category shared, and where it processes.View the full register →
05
Certifications & attestations
We say only what is true today. Where a program is still in progress, we say so plainly rather than implying a certification we do not yet hold.
In progress
SOC 2 Type II
We are building toward a Type II examination covering Security, Availability, and Confidentiality. We will publish the report and bridge letters here, under NDA, once the observation window closes. We do not claim to be certified today.
In place
HIPAA program
Administrative, physical, and technical safeguards, an executed AWS BAA, documented incident-response and data-loss-prevention policies, and per-tenant crypto-shred deletion.
In place
Infrastructure as code
The entire AWS estate — security controls included — is defined in version-controlled Terraform. Changes are reviewed and reproducible, and the security baseline is codified rather than clicked together.
Coordinated disclosure
Found something? Tell us.
We welcome reports from security researchers and treat them seriously. Send us the details and we will acknowledge, investigate, and keep you updated through resolution. Please give us a reasonable window to remediate before any public disclosure, and do not access data that isn't yours while testing.
Report to
security@neolife.healthPGP key available on request. Please include steps to reproduce, the affected surface, and impact.