DenialOS security controls
DenialOS is built for Protected Health Information workflows. Compliance claims should be verified through your contract, deployment, and trust review.
PHI workflow boundaries
Notification, audit, hash, and operational DTO paths restrict patient and claim free text where those details are not required.
Protected document access
Object storage supports short-lived signed URLs, S3 configuration, and optional KMS keys. Final encryption controls depend on deployment configuration.
Audit and access history
Core case, draft, approval, export, outcome, and document-access actions write scoped history for review.
Deployment controls
Production configuration rejects local storage and requires explicit database, authentication, storage, and origin settings.
Role-based access
Organization-scoped access, role checks, Clerk authentication, and session controls protect billing workspaces.
No implied certification
Security certification, BAA, DPA, incident-response, and subprocessor commitments must be verified in the signed customer contract.
Review the deployment before PHI use
Request the current architecture and control summary at trust@denialos.io. Contractual BAA and hosting requirements must be completed before production PHI use.
Request a trust review- Tenant and role model
- Audit and PHI boundaries
- Storage and signed-access configuration
- Migration and deployment controls
- Incident-response ownership
- Contract, BAA, DPA, and subprocessor status