Compliance
InsuredAudit is designed and operated to support the compliance regimes that regulated industries are subject to. The repo’s docs/compliance/ directory contains the authoritative control documentation; the table below is the operator-facing index.
Frameworks
| Framework | Document |
|---|---|
| HIPAA Security Rule | docs/compliance/hipaa-security-rule.md |
| SOC 2 Trust Services Criteria | docs/compliance/soc2-trust-services-criteria.md |
| Risk register | docs/compliance/risk-register.md |
| Data flow diagrams | docs/compliance/data-flow-diagrams.md |
| Evidence pointers | docs/compliance/control-evidence-pointers.md |
Business Associate Agreement
A pre-negotiated BAA template lives at docs/compliance/baa-template.md. Operators send it for every prospective HIPAA-regulated customer. Modifications are permitted with legal review; common riders (sub-processor list, breach-notification window) are pre-flagged in the template.
Data residency & sub-processors
- Primary region: US-East. Secondary (WORM mirror, see
docs/operator/backup-and-dr.md): US-West. - Sub-processors: Cloudflare (edge + tunnel), AWS S3-compatible object store (WORM blob persistence), Postmark (transactional email). The full list with addresses lives in the BAA template.
Audit log access
Customers can pull their chain-of-custody log via GET /v1/custody/{type}/{id} for any object they have read scope on. Tenant-wide custody exports are provided on request — file a ticket via [email protected].