Security
Security, built in layers.
How we build software for environments where the data is sensitive. This page describes our engineering practices. It is not a certification or a legal attestation.
This website does not process PHI
Defense in depth
What we do on every build
Baseline practices we bring to client work, adapted to each environment and its constraints. Pick a layer to see the controls.
Layer 1 of 5
Identity & access
Access is scoped to what a task needs.
- Least-privilege roles (RBAC)
- SSO and MFA where the platform supports it
- Production access limited, deliberate and time-boxed
- Access reviewed, not assumed
Regulated data
Working with PHI and other regulated data
When an engagement involves protected health information or other regulated data, a Business Associate Agreement — or the equivalent for your context — is put in place as part of contracting, before any such data is handled.
During discovery we scope which regulatory obligations apply to the specific system, decide where data lives and moves, and design to meet those obligations. We document the resulting data flows so your team, or an auditor, can follow how information is handled.
We do not hold SOC 2 or HIPAA certification, and nothing on this site should be read as claiming otherwise. Compliance posture is established per engagement, together with your compliance and legal teams. We are the engineering partner in that work, not a certifying body.
Responsible disclosure
Reporting a security concern
If you believe you've found a security issue in something we run, email hello@revotechlabs.org with the subject “Security”. We'll acknowledge it and follow up. Please don't include exploit details or any real data in the first message.
Questions about how we'd handle your data?
Bring your security and compliance teams into the first call. Business inquiries only, no patient information.