Compliance
The workspace region decides where compute may run
AdaptivMapr maps regulated data, so the interesting part of a compliance page is not the list of frameworks — it is the list of things a vendor refuses to overstate. Every row below names the file or the filed clause it came from.
The posture
Three sentences a reviewer can check.
One thing we hold, one thing that limits exposure, and one thing that is still open. If a vendor's compliance page has no third category, it is a brochure.
What we hold
HIPAA-ready, not HIPAA certified
We act as a Business Associate, we offer our own BAA, and we hold a HIPAA Security Risk Assessment on file. No vendor holds a “HIPAA certification” — no such thing exists in U.S. law — so we do not claim one, and you should treat anyone who does with suspicion.
FiledSecurity Risk Assessment produced under 45 CFR § 164.308(a)(1)(ii)(A), following the structure of the HHS/ONC SRA Tool. Held internally; request it at compliance@adaptivmapr.com.
What limits exposure
Most imports send three rows, clamped
Schema-only is a data-minimisation mode, not a trial tier: only column headers and up to three sample values per column, each truncated to 80 characters, ever leave your tenant — and that same clamp is re-applied at the model boundary, so nothing wider can reach a provider even if a caller asks.
EnforcedOne chokepoint — clampForSchemaOnly() in lib/parser.ts — applied at the HTTP edge in every /api/v1 route that accepts sample rows, and re-applied at the LLM boundary.
What is still open
SOC 2 Type II is in progress
The observation window is running. There is no attestation report yet, so there is nothing for us to send you. Our hosting providers hold their own SOC 2 Type II reports — that is their attestation, not ours, and we will not present it as ours.
StatusWe do not hold SOC 2 Type II, HITRUST or ISO 27001 today. /legal/security §7 carries the status; §8 is the binding statement of what we do not claim.
- BAA offered · HIPAA SRA on file
- Headers + ≤3 rows in schema-only
- PHI routing blocked until you accept
- Hash-chained audit_logs
- Uploads expire on a KV TTL, 24h by default
Frameworks
Four states, because two would be a lie.
A framework is either carrying your traffic today or it is not, and the two reasons it might not — the work is unfinished, or the coverage waits on a contract someone else has to sign — are different answers to your question. The legend under the table says which is which.
| Framework | Scope | State |
|---|---|---|
| HIPAA (as a Business Associate)AdaptivMapr is HIPAA-ready: we offer our own BAA covering our role as a business associate, and we hold a HIPAA Security Risk Assessment on file under 45 CFR § 164.308(a)(1)(ii)(A). HIPAA is not a certification anyone can hold, so we do not claim one./legal/security §8 · app/legal/operational/hipaa-sra | United States · full-data mode | In force |
| GDPR (EU 2016/679)Processing runs under our DPA, with Standard Contractual Clauses incorporated by reference. The subprocessor list is maintained publicly and changes are announced at least 30 days in advance./legal/dpa Art. 8 · /legal/subprocessors §3 | European Union | In force |
| nFADP (Switzerland, 2020)The Swiss Federal Act on Data Protection is treated as equivalent to GDPR for the purposes of customer obligations. CH is the default workspace region pin./legal/security §7 · lib/workspaceSettings.ts DEFAULTS.region | Switzerland | In force |
| UK GDPR / DPA 2018Covered by the same DPA. UK is one of the four jurisdictions the reshape sandbox will accept as a compliant placement./legal/privacy §1 · lib/reshape/sandbox.ts SANDBOX_REGIONS | United Kingdom | In force |
| CCPA / CPRAWe do not sell or share personal data within the meaning of California law./legal/security §7 | California | In force |
| SOC 2 Type IIObservation window in progress. No attestation report exists yet, so we do not present one. Our hosting providers hold their own SOC 2 Type II reports, available from each provider under NDA — that is their attestation, not ours./legal/security §6, §7 | AdaptivMapr platform | In progress |
| Cloudflare BAACloudflare offers a HIPAA BAA on its Enterprise plan. Every request, including full-data PHI uploads, runs on Cloudflare Workers and KV, so BAA coverage of this layer depends on that agreement being in force for the production account — it is a contract fact, stated in the deployment certificate we send on request, not something this page can switch on./legal/subprocessors §2 | Workers compute, KV, Queues | Contract-dependent |
| Supabase HIPAA add-onSupabase offers a BAA with its HIPAA add-on on the Team and Enterprise plans. The database holds full-data upload mirrors, remembered chats and the audit log, so BAA coverage of this layer depends on that add-on being in force for the production project — stated in the deployment certificate we send on request./legal/subprocessors §2 | Account metadata, audit log, upload mirror | Contract-dependent |
| phi-cloud BAA chainphi-cloud holds BAAs with the model providers it uses for PHI-routed calls (Infomaniak, Scaleway, Microsoft Azure). Standard-routed calls go to general models that are not under a BAA (Inception Labs, Z.ai) and never carry X-PHI. It is a chain of agreements, not a certificate we hold./legal/subprocessors §2 · lib/llm.ts | PHI-routed model calls | Contract-dependent |
| HITRUST · ISO 27001 · "HIPAA certified"We do not hold these and do not claim them. No "HIPAA certified" status exists in U.S. law for any vendor to hold./legal/security §8 | — | Not claimed |
- In force
- It applies to your traffic today, with no further step by anyone.
- In progress
- Work has started and there is nothing to send you yet. Ask for the date, not the badge.
- Contract-dependent
- The coverage exists only once the operator has executed the upstream paid agreement — the honest label for an inherited posture.
- Not claimed
- We do not hold it and will not imply we do. This is where most of the damage is usually done.
The source line under each framework names the file or the clause that row was read from. Where this page and a document under /legal disagree, the document is binding and this page is the bug — tell us at compliance@adaptivmapr.com.
Data minimisation
The cheapest way to protect a record is not to send it.
Schema-only and full-data are two modes of the same cascade, not two tiers of a plan. Both draw the same small flat per-map fee; only one of them can see a row of your data.
Schema-only — the default path
The cascade resolves columns from statistics, heuristics and fuzzy matching before any model is consulted, so most of a file is settled without one. What still reaches the metered layer in schema-only mode sees only the clamped sample — headers plus at most three values per column, 80 characters each — which is why a DPA is usually unnecessary; one is provided on request.
Contract≤3 rows, each cell ≤80 characters. Nothing else leaves. parsed_rows is null in this mode (DPA Art. 8, Supabase row).
Full-data — in-region, under a BAA
Row-level AI cleanup goes to phi-cloud with X-PHI and X-Region set, so the gateway is forced to pick a PHI-eligible, in-region model. It is locked until your workspace accepts the BAA/NDA in the app, and it carries a 20% surcharge on the whole map charge.
GatedAn explicit PHI ask with no acceptance on file returns 403 agreement_required plus a settings_url pointer. There is no silent downgrade to the general catalogue.
- Unstructured input is always PHI-routed
- Asking for standard routing on it returns
400 phi_required_for_full_data. The server owns that rule, not the client. - The surcharge follows the run, not the setting
- If a reshape’s sandbox execution had PHI routing stripped, that run is billed at the standard rate and carries a
phi_downgradedaudit flag and a warning on the result. We do not charge a BAA premium for a run that bypassed the BAA gate. - Risky templates are flagged, not queued
- 13 of the 33 templates across 7 packs are medium- or high-risk (8 and 5), and come back
requires_hitl: trueso you can gate your own commit. There is no review queue on our side in v1 — the flag is the whole feature.
See how the two modes differ and how a run resolves its routing.
The BAA gate
PHI routing is locked until you accept it.
A signed agreement that lives in a filing cabinet protects nobody. Acceptance is recorded in the product, and the gate reads it on every run — so a workspace cannot route PHI on the strength of an intention.
- 1Standard is what you get
tenants.phi_mode defaults to false. An unconfigured workspace runs standard routing — we never silently upgrade unknown traffic into the surcharge and the agreement gate.
- 2You accept in the app
Settings → Security & Data records the BAA/NDA acceptance against your workspace in public.tenant_agreements, readable and writable at /api/v1/me/agreements.
- 3The gate reads it per run
resolveRunPhi() resolves the per-run choice against the workspace default; an explicit PHI ask with no acceptance on file is refused, not downgraded.
- 4Failure resolves to standard
Every fail-soft path defaults to standard routing on an unreadable settings row. The safe direction here is the cheaper, less regulated one.
# An explicit PHI ask from a workspace that has not accepted.
curl -X POST https://api.adaptivmapr.com/v1/reshape \
-H "Authorization: Bearer mp_live_…" \
-H "content-type: application/json" \
-d '{"phi_mode": true, "upload_id": "upl_…"}'HTTP/1.1 403 Forbidden
{
"error": {
"code": "agreement_required",
"message": "PHI / enterprise processing requires the Business
Associate Agreement and confidentiality terms to be
accepted for this workspace.",
"agreement": { "kind": "phi_baa_nda", "version": "…", "title": "…" },
"settings_url": "/dashboard/settings?tab=security#agreements"
}
}→ refused, with a pointer to where you can fix it — never a quiet downgrade
How hard the gate bites
- MAPR_BAA_ENFORCE=strictThe production setting.
- Every PHI-routed run requires an in-app acceptance on file.
- MAPR_BAA_ENFORCE=explicitThe code default when the variable is unset.
- Only an explicit PHI ask is refused; a run that merely inherits an existing workspace phi_mode is grandfathered.
- MAPR_BAA_ENFORCE=off
- Advisory only — the gate reports but does not block.
Audit & erasure
Six controls you can name in a questionnaire.
Not “enterprise-grade security”. The store, the enforcement point, and the rule that keeps each one honest.
One append-only trail
Key creation and revocation, mapping commits, confirmations, billing events, erasure intents and PHI-agreement acceptances are written to a hash-chained audit log, scoped to your workspace.
WhereSupabase audit_logs; the audit_logs_chain_assign trigger assigns chain_seq, hash and prev_hash per tenant atomically. The external CHAINLOG_* variables are a legacy fallback, not the primary sink.
Written even after the response
Audit writes, wallet debits and usage reports are registered with the Worker’s waitUntil rather than fired and forgotten, because a Cloudflare isolate may stop the moment a response is returned.
HowafterResponse() in lib/backgroundWork.ts. Every billing, metering, audit and email call site was migrated to it.
Content is never the payload
A remembered Chat conversation records ids, counts, byte sizes and the routing a run got in the audit log — never the text of a message or a cell of your data. Separately, the prompt-injection signal log keeps an excerpt of text around a suspected manipulation attempt for 180 days. An incognito chat leaves no trail in either.
Eventworkbench.chat in audit_logs, via lib/workbenchChatAudit.ts. Chat memory follows PHI routing: on a PHI-routed run it defaults to off.
Uploads expire on their own
Parsed uploads live in Cloudflare KV under a native TTL and are mirrored to Supabase for the same window. Expiry is the storage layer’s job, not a cleanup job that can fail silently.
Window24 hours by default, set per workspace to 0, 24, 168 or 720 hours — createUpload() writes that figure straight into the KV expirationTtl. 0 means delete-on-commit. Reads are service-role with an explicit tenant_id filter.
Erasure is one implementation
“Delete workspace” and “Delete account” run the same code path: audit event first, then the stores outside the database (KV copies, the phi-cloud key, the Stripe customer), then one database transaction that erases the workspace and its whole audit log, checks every table for leftovers and leaves one anonymous tombstone. Both require a CSRF token and a typed confirmation string.
Rulelib/workspaceErasure.ts + public.erase_tenant(). Neither route may report success unless the erasure is complete — a failed erasure returns an error, never “Account deleted”.
Isolation is enforced by the database
The dashboard plane runs on your own Supabase user JWT, so row-level security is the gate rather than application code. Uploads, connectors and the v1 bearer API run service-role with an explicit tenant_id on every read.
Identityauth.users.id → tenants.id via a handle_new_user trigger populating tenant_members. v1 API keys are HMAC-signed and self-contained, with a Supabase revocation check that fails closed.
The binding documents
This page is a summary. These are the instruments.
Where a sentence here and a clause there disagree, the clause governs. Send them to your counsel before you send us a questionnaire — most of the answers are already in them.
Data Processing AddendumGDPR / nFADP aligned, with Standard Contractual Clauses incorporated by reference. Article 8 names every subprocessor.OpenSecurity overviewControls, hosting, encryption, §7 on compliance status, and §8 — the binding statement of how PHI is handled in the cascade.OpenSubprocessor listEvery vendor that processes customer data, with role, region and BAA/DPA status. 30 days’ notice of any change.OpenPrivacy PolicyWhat personal data we collect, the legal bases we rely on, and the rights you can exercise.OpenTerms of ServiceThe commercial agreement, including the prepaid wallet.OpenYour data, in plain termsThe non-legal version: what we store, in which system, for how long, and exactly what happens when you press delete.Open
Operational instruments — the Security Risk Assessment, the incident response plan, the breach notification procedure, the security officer designation, and the sanction and training policy — are held internally and released on request under NDA. Ask at compliance@adaptivmapr.com. Data-protection requests go to dpo@adaptivmapr.com; security disclosures to security@adaptivmapr.com.
Ask us the hard question first.
If a control below the line matters to your deployment, we would rather tell you now that it is contract-dependent than have you find out in a review.