Security
Last updated: November 2026
Protected health information
Most of the platform’s APIs serve public data. The services that receive protected health information accept real patient data only from an organization on the Team or Scale plan with a business associate agreement (BAA) in force. Without one, they accept only test data marked as such. If a service cannot confirm the agreement, it refuses the request. The platform’s logs never hold the body of a request. Each call to the API is logged with the organization and key that made it, and that log is kept for at least a year.
Request a BAA from the Support page in your dashboard. What each service receives, keeps and logs is on Patient data in the docs.
Encryption
The platform accepts and returns data only over encrypted connections, and the data it stores is encrypted at rest.
Access
haau3’s administrative tools admit only named people, and everyone who can change haau3’s code signs in with two factors.
How changes ship
Every code change is made in a pull request that passes automated tests and a secret scan. Known vulnerabilities in the software haau3 depends on are tracked and fixed.
Monitoring and incidents
The API is monitored, and its alerts reach haau3’s security official. If an incident affects a customer’s protected health information, haau3 tells the customer as its BAA requires. haau3 keeps written security policies and a risk analysis, and reviews both at least once a year.
Subprocessors
These companies handle data for haau3. Google, under its business associate agreement with haau3, is the only one that processes protected health information. When a Service sends a request to another party for you, such as a member’s request to the member’s own health plan, that party receives only what the request needs.
| Company | What it handles | Receives PHI |
|---|---|---|
| Google Cloud | Runs the API and keeps its logs. | Yes |
| Neon | Holds the platform’s database: organizations, API keys, usage and agreement records. | No |
| Clerk | Signs you in and keeps your organization and its plan. | No |
| Stripe | Processes card payments for paid plans, through Clerk. haau3 never receives or stores your card number. | No |
| Vercel | Hosts this site and counts its page views. | No |
| Mintlify | Hosts our documentation site, docs.haau3.com, and keeps its visitor analytics. | No |
| DocuSign | Carries the business associate agreement to the person who signs it, and keeps each signer’s name and email. | No |
| Google Workspace | Carries our email. An email about an incident, or one you send us, can hold protected health information, which Google’s business associate agreement covers. | Yes |
Some requests are answered live by a public source, which receives what the request asks for and nothing about your account: CMS’s National Provider Directory, the NPPES NPI Registry, LOINC, the site that publishes a requested form, and Mark Cuban Cost Plus Drug Company.
Report a security issue
To report a vulnerability or a security incident, email security@haau3.com.
The same address is in our security.txt.
For a security review of haau3, write to hello@haau3.com.