HIPAA mode and PHI projects
Store protected health information (PHI) on Sovaria: an Enterprise add-on with a signed BAA that turns on MFA for every member, shorter sessions, six-year audit logs and per-project PHI protections.
HIPAA mode is for organizations whose apps store protected health information. It is an Enterprise add-on that Sovaria switches on for your organization once you have signed a Business Associate Agreement (BAA) with us. You then mark each project that holds PHI; those projects get stricter rules at every layer. Sovaria is not "HIPAA certified" — there is no such certification — HIPAA compliance is shared: we provide these controls, you configure your app and your own policies.
How it works
For the whole organization (HIPAA mode on)
- Every console member needs two-factor authentication (authenticator app or passkey). Members without it lose access to the organization until they set it up.
- Sessions end after 15 minutes without activity and after 12 hours in total.
- Audit logs are kept at least 6 years (2,190 days).
- Features outside the AWS BAA are turned off: the Sovariq AI assistant and project agents, log drains to third-party services, third-party integrations (Slack, Discord, Vercel…), and SMS one-time passwords. Calls return
403 HIPAA_FEATURE_UNAVAILABLE.
For projects marked as holding PHI
| Rule | What you see |
|---|---|
| No public buckets or public file links | Creating or switching a bucket to public returns 403 PHI_PUBLIC_BUCKET_DISABLED; existing public links stop working. Use signed URLs. |
| The anon key can sign users in but not read or write data | Data calls with the anon key return 403 PHI_ANON_KEY_DISABLED. Call with the signed-in user's token (row policies still apply) or from your server with a service key. |
| Every data request is logged, reads included | Each request is written to your organization's hash-chained audit log with who, what and when (no row contents). |
| Backups are encrypted | Backups are only taken encrypted; Sovaria never writes a plaintext dump of a PHI project. |
| App user sessions | Your project's session settings can only be stricter than 15 minutes idle / 12 hours total. |
These project rules stay on even if HIPAA mode is later turned off for the organization: only unmarking the project removes them.
Turn it on
Sign the BAA
On the Enterprise plan, contact support or your account manager. Sovaria turns HIPAA mode on for the organization (recorded with the BAA reference).
Set up MFA for everyone
Each member enables two-factor authentication under Account → Security.
Prepare the project
Make public buckets private and move anything your app reads with the anon key behind signed-in users and policies.
Mark the project
In Project settings → Security → HIPAA, turn on This project stores PHI.
GET /api/v1/project-settings/compliance
X-Sovaria-Project-ID: <project-id>
PUT /api/v1/project-settings
{ "settings": { "containsPHI": true } }Sovaria staff access
Sovaria staff can't query your databases. To look at your organization as one of your users (for a support case), a staff member needs a time-boxed access grant with a reason; the grant appears in Organization → Access transparency, the session is read-only, and every request made in it is written to your audit log.
Plans
| Free | Pro | Ultra | Team | Enterprise | |
|---|---|---|---|---|---|
| HIPAA mode (with a signed BAA) | — | — | — | — | Add-on |
Common mistakes
- Marking a project as PHI while the app still reads data with the anon key — those calls start failing. Sign users in first.
- Storing PHI in a project that isn't marked. The PHI protections only apply to marked projects.
- Putting PHI in function logs or error messages. Logs are kept per plan and are not a place for patient data.