HIPAA compliance is built in, not bolted on
Every piece of Protected Health Information in Tendara is encrypted, isolated, and access-controlled. We don't just check the compliance box — we engineered the platform around it.
Encryption at rest
All PHI is encrypted using AES-256-GCM at the application layer before it ever touches the database. Even if someone accessed the raw database, they'd see only ciphertext.
Encryption in transit
All data transmitted between caregivers, admins, and the server uses TLS 1.3. No exceptions.
Row-level security
Multi-tenant isolation via Supabase RLS. Agency A cannot see Agency B's data — enforced at the database level, not the application level.
Self-hosted infrastructure
Your data lives on our own Vultr VPS — not a shared cloud database. We control the hardware, the network, and the access.
Business Associate Agreement
Every agency receives a signed BAA before accessing the platform. This is non-negotiable and automatic.
Audit logging
Every access to PHI is logged: who, when, what record, what action. Immutable audit trail for compliance reviews.
Ready to run your agency on a HIPAA-compliant platform?
Start your free 30-day trial. We'll set up your first clients personally.
No credit card · HIPAA compliant · 5-day onboarding · Oklahoma, Texas & Florida · Cancel anytime