Security — Haventri

Tenant isolation

Every organization's data is scoped on every query.
Isolation fails closed: if an agency's data cannot be reached, requests return an error — they are never served from shared data.
An automated guardrail suite of more than 130 tests walks every record-level route and proves one organization's administrator cannot read or modify another organization's records. It runs before every deployment.

Passwords: minimum 12 characters (NIST 800-63B length-first), stored only as salted hashes.
Two-factor authentication via authenticator apps, with single-use hashed recovery codes and a replay guard that rejects reused codes. Agencies can require MFA for admin roles.
Role-tiered idle timeouts and hard session maximums; step-up re-authentication for sensitive actions such as payroll exports and permission changes.
Departing staff are cut off automatically: an employment end date deactivates the account and revokes mobile tokens at the boundary, backed by an automated sweep.

Database-driven roles and granular permissions; clinicians see their own caseload, not the agency's.
Care-team messaging access is derived from the current care team at view time — leave the team, lose the thread, immediately.
Pay-rate visibility, exports, and administrative actions are individually permission-gated.

Sends, reads, exports, permission changes, and administrative actions are logged with identifiers and counts only — audit entries never contain patient content.
Background jobs (backups, access sweeps) record their outcomes and are monitored for staleness.

TLS for every connection; encrypted storage at rest.
Server-held backup snapshots are encrypted, and the system fails closed rather than ever writing an unencrypted snapshot. Customer-downloaded exports transfer over TLS into the agency's custody.

Ask us for our security packet — including our subprocessor list, BAA availability, and an incident-response summary — at security@haventri.com.