Security & Compliance
AegisSage was architected from day one as a HIPAA-compliant healthcare software platform. Every layer of our stack — from database encryption to API authentication — is designed to protect Medicare beneficiary data with enterprise-grade rigor.
HIPAA Compliant
PHI under BAA
AES-256 Encrypted
At rest + in transit
BAA Available
Upon request
AES-256 Encryption at Rest
All Protected Health Information stored within AegisSage — including Medicare Beneficiary Identifiers (MBIs), date-of-birth fields, and enrollment records — is encrypted at rest using AES-256-GCM. Encryption keys are managed using a hardware security module (HSM) and rotated on a 90-day schedule. Encryption is applied at the row level for PHI fields, meaning database administrators cannot read PHI values without proper key authorization.
TLS 1.3 Encryption in Transit
All data transmitted between clients and AegisSage servers is encrypted using TLS 1.3. TLS 1.0 and 1.1 are explicitly disabled. Certificate pinning is enforced for the Chrome Extension API communication layer. All API endpoints use HTTPS exclusively — HTTP is redirected and blocked. Connections to third-party sub-processors (carrier roster APIs, email delivery) are verified via certificate authority validation.
Infrastructure & Hosting
AegisSage's database infrastructure runs on Supabase hosted on AWS in the us-east-1 region, which is a HIPAA-eligible AWS service region. AWS maintains HITRUST CSF, SOC 1, SOC 2, and SOC 3 certifications. Application servers are hosted on Vercel's edge network; PHI is never transmitted to or processed by Vercel's infrastructure — all PHI operations run server-side within the AWS-backed database layer. Infrastructure access is restricted to named personnel via multi-factor authentication and zero-trust network policies.
Access Controls & Audit Logging
AegisSage enforces role-based access control (RBAC) at both the application and database layers. Roles include Agency Owner, Agency Admin, Customer Service, Broker, and Solo Broker — each with distinct permission boundaries enforced via Row Level Security (RLS) policies in the database. All PHI access events (view, export, MBI reveal) are written to an immutable audit log with timestamp, user ID, and action type. Audit logs are retained for a minimum of six years in compliance with HIPAA requirements.
API Security & Extension Authentication
All AegisSage API endpoints are authenticated via Supabase JWT tokens validated server-side on every request. The Chrome Extension integration uses a separate 64-character hex API key scoped to the individual broker, rotated on demand, and stored in the browser's secure local storage (never in plaintext). Extension API keys do not grant access to PHI — they are scoped exclusively to triggering sync operations and reading non-sensitive enrollment status signals.
Business Associate Agreements (BAAs)
Business Associate Agreements are available upon request and required for all Agency Plan customers who will transmit or process Protected Health Information through the platform. Our standard BAA is modeled on the HHS model BAA template and covers all sub-processors with access to PHI. BAA execution is handled by our compliance team within 3 business days. Individual brokers using the platform for their own client records may request a BAA at any time. Contact compliance@aegissage.com to initiate the BAA process.
Request a BAA
Business Associate Agreements are available upon request for all Agency Plan customers and any broker who requires formal HIPAA documentation. BAA execution typically takes 3 business days and requires a signed countersignature from your designated HIPAA Compliance Officer or equivalent.
Response within 3 business days