Security & compliance
Every control an auditor asks about maps to something real in the system. Build it in and the audit confirms reality. Skip it and you spend a year retrofitting under deal pressure, usually with a signed contract waiting on the other side.
Frameworks
SOC 2
We architect and document to it. Your auditor issues it.
SOC 2 is an attestation about your organization, produced by an independent CPA firm. No agency can hand it to you. What we can do is build the system so the controls already exist and the evidence is already being collected — access reviews, change management, audit logging, encryption, vendor management, incident response — so the audit confirms reality instead of forcing a scramble.
HIPAA
Built for protected health information.
HIPAA governs protected health information. 42 CFR Part 2 governs records from federally assisted substance use disorder programs, and it is materially stricter than HIPAA on redisclosure — a distinction most agencies serving behavioral health and recovery housing have never heard of. We design minimum-necessary data flows, sign BAAs, and keep PHI out of analytics, ad pixels and session tooling entirely.
WCAG 2.2 AA
Built in from the first commit. Not retrofitted.
WCAG is the technical standard; ADA Title III is the legal exposure. Accessible markup, contrast ratios, focus states, keyboard paths and semantic structure cost close to nothing when they are part of the build and a fortune when they are bolted on. They are also, not coincidentally, the same discipline that makes a page legible in the first place.
Read this part
We are not a certifying body and neither is any other agency. SOC 2 is an attestation issued by an independent CPA firm to your organization about your controls. Nobody can sell it to you, and any vendor implying otherwise is either confused or counting on you being confused.
HIPAA has no government certification at all. There is no HIPAA certificate. There are covered entities, business associates, signed agreements and a set of required safeguards — and vendors selling "HIPAA certified" badges are selling a thing that does not exist.
What we do is narrower and more useful: architect the system so the controls are real, document them so they are demonstrable, and wire up evidence collection so the audit is a confirmation rather than an archaeology project. When you bring in an auditor, they should find what we said they would find.
In practice
01
Authorization that lives only in application code is one forgotten clause away from a breach. Where the platform supports it, we push the rule down to the database with row-level security — Azure SQL, Postgres, Supabase — so a query returns what the user is entitled to whether or not the app remembered to ask.
02
Single sign-on, enforced MFA, conditional access, and a quarterly access review that someone actually performs. In Microsoft environments this is Entra ID and it is almost always already licensed and almost never fully configured.
03
Audit logs, change management through pull requests, automated dependency scanning and infrastructure-as-code. Evidence you have to assemble retroactively is evidence you did not have at the time.
04
The safest record is the one you never collected and the safest vendor is the one that never sees it. We design intake, analytics and advertising so sensitive fields never leave your boundary in the first place.
05
A backup nobody has restored is a hypothesis. We test recovery on a schedule and document how long it actually took, because the number in the vendor brochure is not the number.
06
Consent gates loading, not just logging. No session replay on pages collecting health, financial or legal information. No identifiers in confirmation URLs. This is where most marketing-driven privacy exposure actually lives.
Also relevant
If you already have one from a customer, forward it. We will tell you which items your current architecture answers and which ones it does not — before you engage us.