Security & Compliance

1. Encryption

2. Authentication & Access Control

Multi-Factor Authentication (MFA)

• Required for every staff account (Super Admin, CAO, Case Manager) — no exceptions.
• TOTP (RFC 6238) via authenticator apps; SMS fallback disabled by default per NIST 800-63B guidance.
• Session tokens rotate on every privilege escalation; idle sessions expire in 30 minutes.
• Failed-login lockout with exponential back-off + brute-force alerting.

Role-Based Access Control (RBAC)

The Platform enforces a strict role hierarchy — root › super_admin › case_management_officer › case_manager › staff › vendor › resident — with per-resource scoping so that:

• A case manager only sees residents on their caseload.
• A vendor sees only invoices and paycheck mirrors linked to their organization.
• A resident sees only their own portal — no cross-visibility ever.
• Sensitive data classes (behavioral health, survivor history, financial records) require an additional per-record entitlement on top of role rank.

Every read of a sensitive record is logged with actor, resource, and justification — see § 3 Audit Logging.

3. Audit Logging

The Platform maintains an immutable, append-only audit trailof every state-changing action and every read of a sensitive resource. Concretely:

• Every write to a resident record, financial transaction, invoice, or milestone emits a signed audit event.
• Every login, MFA challenge, session refresh, and permission change is logged.
• Audit events include actor UUID, resource UUID, action verb, IP, user-agent, timestamp (UTC ISO 8601), and cryptographic hash chained to the previous event.
• Retention: 7 years (HIPAA § 164.316(b)(2)(i)).
• Audit tables cannot be edited from the application — only exported through a break-glass process that itself emits an audit event.

4. Sub-Processors

We maintain a current sub-processor list on request. Key vendors:

5. Vulnerability Management

• Dependency scanning on every build (yarn audit + pip-audit).
• Static analysis and lint gates block merges with critical findings.
• Quarterly penetration testing by an independent third party (next engagement Q2 2026).
• Coordinated disclosure — please email security@theexchangealliance.org for responsible-disclosure reports; we respond within 72 hours.

6. Incident Response

• Documented Incident Response Plan (IRP), reviewed annually.
• 24-hour notification to affected covered entities under executed BAAs.
• 60-day HHS Office for Civil Rights notification for reportable HIPAA breaches (§ 164.408).
• Post-incident report and remediation timeline shared with affected parties.

7. Business Continuity

• Point-in-time database restore up to 7 days.
• Weekly full backups retained 90 days; monthly retained 7 years.
• Documented Business Continuity + Disaster Recovery plan; recovery time objective (RTO) 24 hours, recovery point objective (RPO) 24 hours.
• Annual DR test scheduled H2 2026.

8. Assurance Roadmap

9. How to Verify

• Request our internal Security Whitepaper, HIPAA Security Rule crosswalk, or IRP → compliance@theexchangealliance.org
• Request or execute a Business Associate Agreement
• Read the HIPAA Notice of Privacy Practices
• Report a security concern → security@theexchangealliance.org