Security

Security overview

This page describes the security posture of the public PowerChart90 deployment. It is not a SOC 2 report or penetration-test certificate.

Effective date: August 17, 2026 · Last updated: August 17, 2026

1. Architecture (high level)

• Static site and serverless functions hosted on Netlify
• Browser may extract text from uploaded files locally
• Scan requests POST JSON (notes + metadata) to powerchart90-engine over HTTPS
• Engine requests require a valid PowerChart90 session token
• Optional LLM inference via OpenAI/Anthropic when API keys are configured for the site

2. Access control

• Username/password verified by the powerchart90-gate function (not solely in client JavaScript)
• HMAC-signed session tokens with expiration
• Tool UI redirects unauthenticated users to login

3. Encryption

• TLS in transit via the hosting CDN
• At-rest encryption is provided by the hosting/cloud providers’ platform defaults for stored deploy artifacts and logs

4. Subprocessors

• Netlify — hosting, functions, edge/CDN, operational logs
• OpenAI — optional model inference
• Anthropic — optional model inference

5. Logging, retention, backups

Function invocations may produce operational logs (time, status, coarse metadata). Chart text is processed to fulfill the request and is not offered as a permanent clinical repository. Deletion requests: audit-defense@pdpmauditgroup.com. See Privacy Notice §5.

6. Code-table freshness (CMS / OIG)

PowerChart90 refreshes CMS ICD-10-CM billable codes and the HHS-OIG LEIE NPI set on a nightly schedule from public government downloads. The active vintage is shown in scan results and at /powerchart90/data/codes-meta.json. CPT® is not redistributed (AMA copyright).

7. Vulnerability management & testing

We perform ongoing code review of product changes. Independent penetration testing and formal certifications (for example SOC 2) are customer-request items; ask for the latest status under NDA. Absence of a public badge is not a claim that testing never occurs, nor proof of a specific certification.

8. Incident response

1. Detect and contain suspected unauthorized access or disclosure
2. Assess scope and legal notification duties
3. Notify affected customers without unreasonable delay as required by the BAA and applicable law
4. Remediate, document, and improve controls

Report suspected incidents to audit-defense@pdpmauditgroup.com with subject “Security incident.”

9. Customer responsibilities

• Protect login credentials; do not share beyond authorized workforce
• Use de-identified data when possible
• Maintain endpoint security on devices used to access the tool