Vocari control catalogue.

This catalogue documents the current control environment and the remaining readiness work. Status applies to Vocari's program and does not represent an independent audit opinion.

12 domains88 public controls40 implementedReviewed September 2026

Implemented in the product or current operationOperationalizing with policy or evidence work underwayPlanned and not represented as complete

Access control and authorization

Controls that establish individual identity, verify workspace authority, and limit privileged access.

9 controls

Individual user accountsWorkspace access is assigned to named users. Shared user identities are prohibited by the Platform Terms.Implemented

Invite-only account creationNew customer users require a time-limited invitation issued for a specific email address and workspace.Implemented

Password-protected accountsEvery user signs in through an individual invite-only account. Sessions are short-lived and protected workspace APIs require a valid session.Implemented

Role-based authorizationMember, administrator, and owner privileges are enforced by the application service rather than trusted from browser state.Implemented

Workspace membership validationEvery tenant-scoped request resolves and validates the user's workspace membership before data is read or changed.Implemented

Time-limited sessionsAuthenticated sessions expire after a bounded period and sensitive authentication endpoints are rate limited.Implemented

Access removal procedureThe written access policy requires same-business-day removal when workforce or customer authorization ends. Initial adoption and evidence are pending.Operationalizing

Periodic access reviewThe program defines a quarterly review of internal, customer, and privileged vendor access. The first retained review is pending.Operationalizing

Privileged-access inventoryThe evidence register defines the required account, owner, business-purpose, and review records. Initial population is pending.Operationalizing

Data management and protection

Controls governing data separation, transmission, credentials, collection, disclosure, and lifecycle.

10 controls

Workspace data isolationTenant-owned rows, queries, events, credentials, and mutations are scoped to a validated workspace identifier.Implemented

Encryption in transitProduction web traffic uses HTTPS. Strict transport security directs supported browsers to use encrypted connections.Implemented

Protected provider credentialsTenant integration secrets are encrypted on the server and are never returned to customer-facing clients after storage.Implemented

Protected-response cache controlsAuthenticated API responses are marked to prevent storage by browsers, shared proxies, and content-delivery caches.Implemented

Transcript-only retention modelThe current product retains transcripts and workflow records rather than patient call recordings. Audio is processed in real time to provide the voice interaction.Implemented

Purpose-limited collectionPatient workflows use explicit schemas and practice-approved prompts to collect information needed for the configured administrative purpose.Implemented

Customer-controlled disclosurePatient-access information is returned to the originating workspace and approved integrations rather than exposed across customers.Implemented

Data inventory and flow mapThe current HIPAA risk analysis documents the patient-access flow, systems, excluded channels, and vendor boundaries. Founder verification is pending.Operationalizing

Retention and disposal scheduleThe founder policy defines six-year compliance evidence and audit retention, a rolling 30-day backup target, and customer-directed application-data return and deletion. Counsel and technical verification are pending.Operationalizing

Customer export procedureWorkspace exports currently require an authorized owner request, identity and scope verification by Vocari support, an audit record, and secure delivery.Operationalizing

Application and workflow security

Controls protecting provider events, automated actions, healthcare workflows, and failure handling.

8 controls

Authenticated provider eventsInbound provider webhooks are authenticated before their events are processed against the associated workspace and call.Implemented

Replay and duplicate-event protectionProvider event identifiers and idempotency checks prevent a repeated delivery from creating a second mutation.Implemented

Schema-validated actionsOperational tools accept explicit structured arguments and reject missing, malformed, or unsupported values before changing data.Implemented

Scoped integration accessVoice integrations use credentials assigned to the workspace. Platform-managed eligibility uses a protected service credential with patient records and requests scoped to the authorized workspace.Implemented

Safe failure statesCritical processing failures remain visible, receive a named error, and do not return a false success response.Implemented

Human escalation boundariesUncertain identity, clinical judgment, emergencies, unsupported requests, and configured exceptions are directed to healthcare staff.Implemented

Appointment conflict protectionAvailability must be revalidated before booking, and concurrent slot conflicts are returned as explicit failures rather than overwritten.Implemented

Security-focused regression testsAutomated tests cover tenant boundaries, malformed input, authentication failures, duplicate delivery, and critical workflow behavior.Implemented

Change management and software delivery

Controls that make assistant configuration, code changes, and production releases reviewable and recoverable.

7 controls

Version-controlled sourceApplication source and infrastructure configuration are maintained in version control with attributable change history.Implemented

Automated build and type validationLinting, TypeScript validation, automated tests, and production builds are used to detect defects before release.Implemented

Immutable assistant revisionsAssistant configuration is versioned so a published workflow can be associated with the exact approved revision.Implemented

Validated assistant configurationSaved configuration and release dependencies are validated locally. Live sessions use an identifiable release manifest rather than a remotely stored assistant object.Implemented

Rollback preservationPrior assistant releases remain available for rollback, and in-progress calls use their pinned configuration.Implemented

Production deployment restrictionA formal least-privilege roster and recurring review for production deployment access are being documented.Operationalizing

Change approval evidenceVocari is formalizing the required reviewer, emergency-change path, and retained evidence for security-sensitive production changes.Operationalizing

Monitoring and incident response

Controls for recording sensitive activity, detecting failures, investigating events, and notifying affected customers.

8 controls

Sensitive-data access auditAccess to conversations and patient context is recorded with the acting user, workspace, action, and timestamp.Implemented

Administrative change auditSensitive workspace administration already produces attributable audit events in selected paths. Coverage is being extended and verified across every security, user, credential, phone-routing, and BAA-status mutation.Operationalizing

Structured operational errorsCritical paths use named error types with defined handling instead of converting unknown failures into successful results.Implemented

Event quarantineEvents that cannot be authenticated, resolved to a workspace, or safely processed are rejected or quarantined rather than silently accepted.Implemented

Incident response policyA written plan defines severity, ownership, containment, evidence preservation, recovery, communication, and post-incident review. Founder adoption is pending.Operationalizing

Breach assessment and notification procedureThe incident plan defines HIPAA breach assessment factors, customer coordination, evidence, and counsel escalation. The contractual deadline awaits counsel approval.Operationalizing

Incident response exerciseA tabletop exercise and retained corrective-action record will be completed after the incident-response policy is approved.Planned

Centralized security monitoringAlert routing, log review ownership, detection rules, and evidence retention are being formalized across critical services.Operationalizing

Business continuity and recovery

Controls intended to preserve availability and restore critical patient-access services after disruption.

5 controls

Managed infrastructure resilienceThe application uses managed hosting and database services with platform-level redundancy and recovery capabilities subject to the selected service plans.Implemented

Backup configuration verificationVocari is documenting backup scope, frequency, isolation, encryption, retention, and vendor-plan eligibility for every production data store.Operationalizing

Business continuity planA written plan identifies critical services, owners, restoration order, communication paths, dependencies, and safe manual operating alternatives. Exercise evidence is pending.Operationalizing

Recovery objectivesInitial recovery time and recovery point targets are documented for the database, application, voice provider, authentication, and healthcare transactions. Verification is pending.Operationalizing

Restore testingDatabase and configuration recovery procedures will be tested, timed, and retained as evidence on a defined schedule.Planned

Endpoint and workforce security

Administrative and device safeguards for personnel who may access Vocari systems or confidential information.

6 controls

Workforce confidentiality obligationsEmployees and contractors with access to confidential information will sign confidentiality and acceptable-use obligations before access is granted.Operationalizing

Security and HIPAA trainingA founder-sized training module covers PHI, minimum necessary use, devices, accounts, incidents, vendors, and voice AI. Signed founder completion records are pending.Operationalizing

Device encryptionA documented requirement for full-disk encryption on workforce devices that access production or confidential information is being adopted and verified.Operationalizing

Automatic screen lockingWorkforce device standards will require automatic locking and authenticated re-entry after a defined idle period.Operationalizing

Endpoint protectionAnti-malware, host firewall, patching, and endpoint-detection requirements are being standardized for in-scope devices.Operationalizing

Mobile device managementCentral inventory, policy enforcement, and remote-remediation capability for in-scope devices are planned as the workforce grows.Planned

Email and messaging security

Controls for account email, transactional messages, domain authenticity, and sensitive-content handling.

6 controls

Transactional email separationAccount invitations and password-recovery messages use a dedicated server-side delivery integration and do not expose the provider credential to the browser.Implemented

Time-limited security linksInvitation and recovery links are single-purpose, expire after a bounded period, and are sent to the intended account address.Implemented

PHI excluded from account emailAuthentication and account-administration messages are designed to contain user and security metadata rather than patient interaction content.Implemented

Sender-domain authenticationSPF, DKIM, and DMARC records and enforcement will be verified for every production sending domain before broad customer delivery.Operationalizing

Mailbox access restrictionAdministrative access to company mailboxes and security-message routing will be inventoried, least-privileged, MFA-protected, and reviewed.Operationalizing

Malicious-content protectionInbound phishing, malware, unsafe-link, and attachment controls will be documented for in-scope workforce mailboxes.Operationalizing

Infrastructure security

Controls covering cloud boundaries, production access, configuration, network exposure, and infrastructure changes.

10 controls

Server-side secret boundariesProduction provider keys and encryption material remain in server-controlled environments and are excluded from frontend bundles.Implemented

Unique tenant provider credentialsCustomer voice-provider operations use credentials configured for that workspace, reducing shared-secret blast radius.Implemented

Credentialed origin allowlistCredentialed cross-origin requests are restricted to explicitly configured trusted application and Trust Center origins.Implemented

Security response headersProduction responses apply transport, framing, content-type, referrer, permissions, and protected-cache headers appropriate to the route.Implemented

Production database authenticationDatabase access uses service credentials supplied through protected runtime configuration rather than embedded application source.Implemented

Infrastructure asset inventoryA maintained inventory of production services, environments, owners, data classification, and internet exposure is being completed.Operationalizing

Public exposure reviewStorage, database, administrative, and service endpoints will be reviewed for unnecessary public access and documented exceptions.Operationalizing

Infrastructure change reviewMaterial hosting, database, network, and security-control changes will require recorded review and rollback planning.Operationalizing

Web application firewallWAF coverage, managed rules, exclusions, alert ownership, and review cadence will be verified for production domains.Planned

Infrastructure as codeRepeatable, reviewable configuration for critical infrastructure will be adopted where the managed platforms expose appropriate interfaces.Planned

Organizational security and risk management

Governance controls that assign responsibility, document policy, assess risk, and track remediation.

7 controls

Security and privacy responsibilityThe founder program designates Manikanth Martha as Security and Privacy Officer and the co-founder contract owner for legal and BAA administration. Signed adoption is pending.Operationalizing

Policy programVersioned founder policies now cover access, acceptable use, incident response, risk, vendors, data management, continuity, workforce security, and evidence. Signed adoption is pending.Operationalizing

HIPAA security risk analysisThe current analysis maps ePHI flows and documents threats, likelihood, impact, safeguards, residual risk, treatment, and owners. Founder approval and evidence closure are pending.Operationalizing

Risk treatment registerIdentified risks will receive an owner, treatment decision, due date, evidence, and documented acceptance when remediation is deferred.Operationalizing

Workforce sanctionsA documented and consistently applied sanctions process for violations of security and privacy policy is planned with counsel and HR review.Planned

Annual program reviewPolicies, risks, controls, incidents, vendors, and training evidence will be reviewed at least annually and after material change.Planned

Cybersecurity insuranceCyber and technology errors-and-omissions coverage will be evaluated against customer commitments and residual risk.Planned

Vendor and subprocessor management

Controls for service providers that may store, process, transmit, or secure customer information.

6 controls

Purpose-based subprocessor registerVocari documents service-provider categories, processing purpose, data category, and contractual requirement in its Trust Center.Implemented

Vendor inventoryThe internal register names the current hosting, database, voice, transaction, email, and source-control services with purpose, PHI decision, owner, and required approval evidence.Operationalizing

Security review before PHI useVendor plan eligibility, relevant security documentation, data flow, and configuration must be reviewed before a service is approved to process PHI.Operationalizing

Downstream Business Associate AgreementsA BAA is required before a subcontractor creates, receives, maintains, or transmits PHI on Vocari's behalf where HIPAA requires one.Operationalizing

Vendor change and termination reviewOffboarding will address credential revocation, data return or deletion, integration removal, retained data, and evidence of completion.Planned

Material subprocessor noticeCustomer notice terms for material changes to relevant subprocessors will be established in executed agreements.Planned

Vulnerability management

Controls for identifying, prioritizing, remediating, and validating weaknesses in the application and its dependencies.

6 controls

Automated code-quality gatesType checking, linting, tests, and production builds run against the application to identify defects before release.Implemented

Dependency reviewA formal cadence for reviewing vulnerable and outdated dependencies, severity, exploitability, and remediation evidence is being established.Operationalizing

Vulnerability remediation targetsSeverity-based remediation and exception timelines will assign ownership and prevent unresolved findings from disappearing into general backlog.Operationalizing

Automated vulnerability scanningAuthenticated application, dependency, secret, and infrastructure scans will be integrated into the development and release process.Planned

Independent penetration testAn authorized third party will test the production scope before Vocari represents annual penetration-testing coverage.Planned

Responsible disclosure processA public security contact and coordinated vulnerability disclosure procedure are being formalized for good-faith reports.Operationalizing