Source: https://vocarihealth.co/trust/controls # Vocari control catalogue. This catalogue documents the current control environment and the remaining readiness work. Status applies to Vocari's program and does not represent an independent audit opinion. 12 domains 88 public controls 40 implemented Reviewed September 2026 Implemented in the product or current operation Operationalizing with policy or evidence work underway Planned and not represented as complete ## Access control and authorization Controls that establish individual identity, verify workspace authority, and limit privileged access. 9 controls **Individual user accounts** Workspace access is assigned to named users. Shared user identities are prohibited by the Platform Terms. _Implemented_ **Invite-only account creation** New customer users require a time-limited invitation issued for a specific email address and workspace. _Implemented_ **Password-protected accounts** Every user signs in through an individual invite-only account. Sessions are short-lived and protected workspace APIs require a valid session. _Implemented_ **Role-based authorization** Member, administrator, and owner privileges are enforced by the application service rather than trusted from browser state. _Implemented_ **Workspace membership validation** Every tenant-scoped request resolves and validates the user's workspace membership before data is read or changed. _Implemented_ **Time-limited sessions** Authenticated sessions expire after a bounded period and sensitive authentication endpoints are rate limited. _Implemented_ **Access removal procedure** The written access policy requires same-business-day removal when workforce or customer authorization ends. Initial adoption and evidence are pending. _Operationalizing_ **Periodic access review** The program defines a quarterly review of internal, customer, and privileged vendor access. The first retained review is pending. _Operationalizing_ **Privileged-access inventory** The evidence register defines the required account, owner, business-purpose, and review records. Initial population is pending. _Operationalizing_ ## Data management and protection Controls governing data separation, transmission, credentials, collection, disclosure, and lifecycle. 10 controls **Workspace data isolation** Tenant-owned rows, queries, events, credentials, and mutations are scoped to a validated workspace identifier. _Implemented_ **Encryption in transit** Production web traffic uses HTTPS. Strict transport security directs supported browsers to use encrypted connections. _Implemented_ **Protected provider credentials** Tenant integration secrets are encrypted on the server and are never returned to customer-facing clients after storage. _Implemented_ **Protected-response cache controls** Authenticated API responses are marked to prevent storage by browsers, shared proxies, and content-delivery caches. _Implemented_ **Transcript-only retention model** The current product retains transcripts and workflow records rather than patient call recordings. Audio is processed in real time to provide the voice interaction. _Implemented_ **Purpose-limited collection** Patient workflows use explicit schemas and practice-approved prompts to collect information needed for the configured administrative purpose. _Implemented_ **Customer-controlled disclosure** Patient-access information is returned to the originating workspace and approved integrations rather than exposed across customers. _Implemented_ **Data inventory and flow map** The current HIPAA risk analysis documents the patient-access flow, systems, excluded channels, and vendor boundaries. Founder verification is pending. _Operationalizing_ **Retention and disposal schedule** The founder policy defines six-year compliance evidence and audit retention, a rolling 30-day backup target, and customer-directed application-data return and deletion. Counsel and technical verification are pending. _Operationalizing_ **Customer export procedure** Workspace exports currently require an authorized owner request, identity and scope verification by Vocari support, an audit record, and secure delivery. _Operationalizing_ ## Application and workflow security Controls protecting provider events, automated actions, healthcare workflows, and failure handling. 8 controls **Authenticated provider events** Inbound provider webhooks are authenticated before their events are processed against the associated workspace and call. _Implemented_ **Replay and duplicate-event protection** Provider event identifiers and idempotency checks prevent a repeated delivery from creating a second mutation. _Implemented_ **Schema-validated actions** Operational tools accept explicit structured arguments and reject missing, malformed, or unsupported values before changing data. _Implemented_ **Scoped integration access** Voice integrations use credentials assigned to the workspace. Platform-managed eligibility uses a protected service credential with patient records and requests scoped to the authorized workspace. _Implemented_ **Safe failure states** Critical processing failures remain visible, receive a named error, and do not return a false success response. _Implemented_ **Human escalation boundaries** Uncertain identity, clinical judgment, emergencies, unsupported requests, and configured exceptions are directed to healthcare staff. _Implemented_ **Appointment conflict protection** Availability must be revalidated before booking, and concurrent slot conflicts are returned as explicit failures rather than overwritten. _Implemented_ **Security-focused regression tests** Automated tests cover tenant boundaries, malformed input, authentication failures, duplicate delivery, and critical workflow behavior. _Implemented_ ## Change management and software delivery Controls that make assistant configuration, code changes, and production releases reviewable and recoverable. 7 controls **Version-controlled source** Application source and infrastructure configuration are maintained in version control with attributable change history. _Implemented_ **Automated build and type validation** Linting, TypeScript validation, automated tests, and production builds are used to detect defects before release. _Implemented_ **Immutable assistant revisions** Assistant configuration is versioned so a published workflow can be associated with the exact approved revision. _Implemented_ **Validated assistant configuration** Saved configuration and release dependencies are validated locally. Live sessions use an identifiable release manifest rather than a remotely stored assistant object. _Implemented_ **Rollback preservation** Prior assistant releases remain available for rollback, and in-progress calls use their pinned configuration. _Implemented_ **Production deployment restriction** A formal least-privilege roster and recurring review for production deployment access are being documented. _Operationalizing_ **Change approval evidence** Vocari is formalizing the required reviewer, emergency-change path, and retained evidence for security-sensitive production changes. _Operationalizing_ ## Monitoring and incident response Controls for recording sensitive activity, detecting failures, investigating events, and notifying affected customers. 8 controls **Sensitive-data access audit** Access to conversations and patient context is recorded with the acting user, workspace, action, and timestamp. _Implemented_ **Administrative change audit** Sensitive workspace administration already produces attributable audit events in selected paths. Coverage is being extended and verified across every security, user, credential, phone-routing, and BAA-status mutation. _Operationalizing_ **Structured operational errors** Critical paths use named error types with defined handling instead of converting unknown failures into successful results. _Implemented_ **Event quarantine** Events that cannot be authenticated, resolved to a workspace, or safely processed are rejected or quarantined rather than silently accepted. _Implemented_ **Incident response policy** A written plan defines severity, ownership, containment, evidence preservation, recovery, communication, and post-incident review. Founder adoption is pending. _Operationalizing_ **Breach assessment and notification procedure** The incident plan defines HIPAA breach assessment factors, customer coordination, evidence, and counsel escalation. The contractual deadline awaits counsel approval. _Operationalizing_ **Incident response exercise** A tabletop exercise and retained corrective-action record will be completed after the incident-response policy is approved. _Planned_ **Centralized security monitoring** Alert routing, log review ownership, detection rules, and evidence retention are being formalized across critical services. _Operationalizing_ ## Business continuity and recovery Controls intended to preserve availability and restore critical patient-access services after disruption. 5 controls **Managed infrastructure resilience** The application uses managed hosting and database services with platform-level redundancy and recovery capabilities subject to the selected service plans. _Implemented_ **Backup configuration verification** Vocari is documenting backup scope, frequency, isolation, encryption, retention, and vendor-plan eligibility for every production data store. _Operationalizing_ **Business continuity plan** A written plan identifies critical services, owners, restoration order, communication paths, dependencies, and safe manual operating alternatives. Exercise evidence is pending. _Operationalizing_ **Recovery objectives** Initial recovery time and recovery point targets are documented for the database, application, voice provider, authentication, and healthcare transactions. Verification is pending. _Operationalizing_ **Restore testing** Database and configuration recovery procedures will be tested, timed, and retained as evidence on a defined schedule. _Planned_ ## Endpoint and workforce security Administrative and device safeguards for personnel who may access Vocari systems or confidential information. 6 controls **Workforce confidentiality obligations** Employees and contractors with access to confidential information will sign confidentiality and acceptable-use obligations before access is granted. _Operationalizing_ **Security and HIPAA training** A founder-sized training module covers PHI, minimum necessary use, devices, accounts, incidents, vendors, and voice AI. Signed founder completion records are pending. _Operationalizing_ **Device encryption** A documented requirement for full-disk encryption on workforce devices that access production or confidential information is being adopted and verified. _Operationalizing_ **Automatic screen locking** Workforce device standards will require automatic locking and authenticated re-entry after a defined idle period. _Operationalizing_ **Endpoint protection** Anti-malware, host firewall, patching, and endpoint-detection requirements are being standardized for in-scope devices. _Operationalizing_ **Mobile device management** Central inventory, policy enforcement, and remote-remediation capability for in-scope devices are planned as the workforce grows. _Planned_ ## Email and messaging security Controls for account email, transactional messages, domain authenticity, and sensitive-content handling. 6 controls **Transactional email separation** Account invitations and password-recovery messages use a dedicated server-side delivery integration and do not expose the provider credential to the browser. _Implemented_ **Time-limited security links** Invitation and recovery links are single-purpose, expire after a bounded period, and are sent to the intended account address. _Implemented_ **PHI excluded from account email** Authentication and account-administration messages are designed to contain user and security metadata rather than patient interaction content. _Implemented_ **Sender-domain authentication** SPF, DKIM, and DMARC records and enforcement will be verified for every production sending domain before broad customer delivery. _Operationalizing_ **Mailbox access restriction** Administrative access to company mailboxes and security-message routing will be inventoried, least-privileged, MFA-protected, and reviewed. _Operationalizing_ **Malicious-content protection** Inbound phishing, malware, unsafe-link, and attachment controls will be documented for in-scope workforce mailboxes. _Operationalizing_ ## Infrastructure security Controls covering cloud boundaries, production access, configuration, network exposure, and infrastructure changes. 10 controls **Server-side secret boundaries** Production provider keys and encryption material remain in server-controlled environments and are excluded from frontend bundles. _Implemented_ **Unique tenant provider credentials** Customer voice-provider operations use credentials configured for that workspace, reducing shared-secret blast radius. _Implemented_ **Credentialed origin allowlist** Credentialed cross-origin requests are restricted to explicitly configured trusted application and Trust Center origins. _Implemented_ **Security response headers** Production responses apply transport, framing, content-type, referrer, permissions, and protected-cache headers appropriate to the route. _Implemented_ **Production database authentication** Database access uses service credentials supplied through protected runtime configuration rather than embedded application source. _Implemented_ **Infrastructure asset inventory** A maintained inventory of production services, environments, owners, data classification, and internet exposure is being completed. _Operationalizing_ **Public exposure review** Storage, database, administrative, and service endpoints will be reviewed for unnecessary public access and documented exceptions. _Operationalizing_ **Infrastructure change review** Material hosting, database, network, and security-control changes will require recorded review and rollback planning. _Operationalizing_ **Web application firewall** WAF coverage, managed rules, exclusions, alert ownership, and review cadence will be verified for production domains. _Planned_ **Infrastructure as code** Repeatable, reviewable configuration for critical infrastructure will be adopted where the managed platforms expose appropriate interfaces. _Planned_ ## Organizational security and risk management Governance controls that assign responsibility, document policy, assess risk, and track remediation. 7 controls **Security and privacy responsibility** The founder program designates Manikanth Martha as Security and Privacy Officer and the co-founder contract owner for legal and BAA administration. Signed adoption is pending. _Operationalizing_ **Policy program** Versioned founder policies now cover access, acceptable use, incident response, risk, vendors, data management, continuity, workforce security, and evidence. Signed adoption is pending. _Operationalizing_ **HIPAA security risk analysis** The current analysis maps ePHI flows and documents threats, likelihood, impact, safeguards, residual risk, treatment, and owners. Founder approval and evidence closure are pending. _Operationalizing_ **Risk treatment register** Identified risks will receive an owner, treatment decision, due date, evidence, and documented acceptance when remediation is deferred. _Operationalizing_ **Workforce sanctions** A documented and consistently applied sanctions process for violations of security and privacy policy is planned with counsel and HR review. _Planned_ **Annual program review** Policies, risks, controls, incidents, vendors, and training evidence will be reviewed at least annually and after material change. _Planned_ **Cybersecurity insurance** Cyber and technology errors-and-omissions coverage will be evaluated against customer commitments and residual risk. _Planned_ ## Vendor and subprocessor management Controls for service providers that may store, process, transmit, or secure customer information. 6 controls **Purpose-based subprocessor register** Vocari documents service-provider categories, processing purpose, data category, and contractual requirement in its Trust Center. _Implemented_ **Vendor inventory** The internal register names the current hosting, database, voice, transaction, email, and source-control services with purpose, PHI decision, owner, and required approval evidence. _Operationalizing_ **Security review before PHI use** Vendor plan eligibility, relevant security documentation, data flow, and configuration must be reviewed before a service is approved to process PHI. _Operationalizing_ **Downstream Business Associate Agreements** A BAA is required before a subcontractor creates, receives, maintains, or transmits PHI on Vocari's behalf where HIPAA requires one. _Operationalizing_ **Vendor change and termination review** Offboarding will address credential revocation, data return or deletion, integration removal, retained data, and evidence of completion. _Planned_ **Material subprocessor notice** Customer notice terms for material changes to relevant subprocessors will be established in executed agreements. _Planned_ ## Vulnerability management Controls for identifying, prioritizing, remediating, and validating weaknesses in the application and its dependencies. 6 controls **Automated code-quality gates** Type checking, linting, tests, and production builds run against the application to identify defects before release. _Implemented_ **Dependency review** A formal cadence for reviewing vulnerable and outdated dependencies, severity, exploitability, and remediation evidence is being established. _Operationalizing_ **Vulnerability remediation targets** Severity-based remediation and exception timelines will assign ownership and prevent unresolved findings from disappearing into general backlog. _Operationalizing_ **Automated vulnerability scanning** Authenticated application, dependency, secret, and infrastructure scans will be integrated into the development and release process. _Planned_ **Independent penetration test** An authorized third party will test the production scope before Vocari represents annual penetration-testing coverage. _Planned_ **Responsible disclosure process** A public security contact and coordinated vulnerability disclosure procedure are being formalized for good-faith reports. _Operationalizing_