Security & compliance
Built for PHI from the first byte
ProofCustody is a deterministic audit system designed to handle protected health information safely from intake through export. This page summarizes our posture; our full security overview is available on request.
PHI redaction on disclosures and stored documents
Personal and protected health information is redacted on every provider-facing disclosure and in the document text ProofCustody stores and displays for review. Claim data is not sent to third-party analysis services.
Deterministic rules engine
Every finding comes from explicit, versioned rules — not a model guess. The same claim produces the same result, every time, which is what lets a reviewer verify every finding.
Row-level tenant isolation
Tenant isolation is enforced in the database with row-level security under a non-owner application role, and is covered by automated cross-tenant tests. ProofCustody is not yet generally available.
Tamper-evident audit trail
Each finding, decision, and reviewer action is written to a hash-chained, append-only trail capturing the rule-set version (a fingerprint of the rules code), CMS reference edition (NCCI release), reviewer identity, and timestamp.
Encryption in transit & at rest
Live-claim data is encrypted in transit and at rest in the configured HIPAA-eligible production environment.
BAA-ready for live claims
Ghost Audit sample reports run on synthetic sample data — no PHI, no upload, no agreement needed. Live-claim work runs under a Business Associate Agreement and a secure intake workflow.
Request the security pack
Our security overview and BAA template are available now; data-flow and subprocessor detail are shared as an evaluation progresses.
security@proofcustody.comCompliance questions? compliance@proofcustody.com
Have a specific question? Contact us →