01 Our approach
Nora is an autonomous operator working insidea regulated business. Security isn't a feature on the side — it's the substrate the operator runs on.
We build to a defense-in-depth model: assume any single control will fail and design so the next one stops the failure cold. Where the law sets a floor (HIPAA, HITECH, state EVV regulations), we treat the floor as the start, not the end.
02 Hosting & isolation
Nora runs on Google Cloud in U.S. regions. Production runs in its own project, in its own VPC, with no inbound peering to corporate or development environments. There is one public ingress (the application load balancer) and one egress NAT — everything else is private.
- Compute — ephemeral containers, no shell-in to production.
- Data stores — managed services (RDS, DynamoDB, S3) with PHI fields enveloped using customer-specific keys.
- Tenancy — logically isolated per customer; row-level enforcement at the application layer plus per-customer KMS keys at the data layer.
03 Encryption
| Layer | Standard |
|---|---|
| In transit | TLS 1.3, HSTS preload, modern ciphers only. No unencrypted endpoints exist. |
| At rest | AES-256 for all primary stores; envelope encryption for PHI columns using per-customer KMS keys. |
| Backups | Same standards. Encrypted point-in-time snapshots replicated to a second region. |
| Voice / SMS | Telephony providers operate under BAAs. Recordings and transcripts are encrypted on arrival. |
04 Identity & access
- SSO & MFA — every workforce member, no exceptions. Hardware-backed keys for privileged roles.
- Role-based access — least-privilege groups; production access is reviewed quarterly.
- Just-in-time elevation — production sessions require justification, are time-boxed, and are recorded.
- Customer admin model— your agency controls who can see what. Tenant admins can revoke any team member's access in one click.
05 Audit & observability
Every read, write, export, and administrative action that touches PHI is logged with actor, timestamp, action, and record identifier. Logs are immutable, replicated, and retained for six years to satisfy HIPAA. Customer-side audit logs are available via the Nora admin console; raw export on request.
Operationally, we monitor latency, error rates, and anomalous-behavior signals (impossible travel logins, off-hours bulk reads, unusual outbound messaging volumes). Alerts page our on-call engineers around the clock.
06 Secure development
- Code review — every change requires peer approval. Production deploys are blocked without a passing CI.
- Static analysis — automated linting and type-checking on every commit.
- Secret management — secrets live in a managed vault; CI never sees plaintext.
- Branch protection — main is protected, signed commits, no force-push, no direct merges.
07 Vulnerability management
We patch critical CVEs within 48 hours, high-severity within 7 days, and the rest on a regular cadence.
08 Business continuity & disaster recovery
We maintain a documented BCDR plan tested at least annually. Targets:
- RPO — 5 minutes for transactional data.
- RTO — 4 hours for full service restoration in a multi-zone failure; 24 hours for full regional failover.
- Backups — encrypted, replicated across regions, restore-tested every quarter.
09 Incident response
We follow a written IR plan with defined severity levels, runbooks, and on-call rotations. The Privacy Officer is paged for any incident involving customer data. We notify affected customers without unreasonable delay and within HIPAA's 30-day breach-notification window — usually much sooner.
Our standing rule on incidents: tell the customer what happened, what we did, and what we're doing differently — even when the disclosure is uncomfortable. Especially then.
10 Certifications & reports
- HIPAA — administrative, physical, and technical safeguards mapped to 45 CFR §§ 164.308, 164.310, 164.312. Active.
- SOC 2 Type II — planned.
- PCI-DSS — SAQ-A scope (tokenized at our processor). Active.
- HITRUST CSF — planned, post-SOC 2.
Reports and evidence are available to customers and prospects under a mutual NDA. Email security@nora.care to request the security package.
11 Responsible disclosure
If you believe you have found a security issue in Nora, please write to us at security@nora.care. We acknowledge within one business day, investigate every report, and credit researchers in our public disclosures when they wish to be named.
We do not pursue legal action against good-faith researchers who follow standard rules of engagement: no data exfiltration, no service degradation, no privacy violations.