HiveCompass · Privacy · Terms · Security
Security
Last updated 2026-09-23
Built for PHI
HiveCompass holds protected health information for Medicaid members, so Maxivize operates it as a HIPAA business associate on vendors already under BAA (Microsoft Azure, Supabase, OpenAI) and signs a BAA with every agency.
Access
Every table is isolated by agency in the database itself (row-level security); partners and clients reach only projections built for them. Roles limit what each person sees; separation of duties (for example, the person who prepares an invoice cannot submit it) is enforced by the database, not just the screen. Second sign-in step for administrators, billing, compliance and platform roles; lockout after repeated failures; sessions that expire.
Audit
Every read and write of a client record, every recording play, every partner view and every support access writes an append-only event. Events are exported daily to immutable storage kept for 10 years and can be exported by the agency's compliance officer at any time.
Data handling
TLS everywhere; encryption at rest; private storage with short-lived, single-file links; uploads scanned before they are visible to anyone but the uploader; recordings on an explicit access list. Notifications carry a first name and a date at most; AI prompts carry the minimum needed for one client; nothing identifiable goes into logs, analytics or cost meters.
Operations
Secrets live only in Azure Key Vault. Dependencies are scanned; security headers and a strict content security policy are set on every response; public forms are rate-limited. Daily backups with point-in-time recovery are verified weekly with a restore test. A breach runbook and a one-click incident control exist and are rehearsed.
Reporting
Report a vulnerability to security@myhivecompass.com. We acknowledge within two business days and do not pursue researchers who act in good faith and give us time to fix.