AskIsaac.io

Hospital-Grade Security Whitepaper

Document Version 1.0

October 15, 2026

CONFIDENTIAL

Executive Summary

AskIsaac.io operates on a Zero-Trust Architecture, treating every request as a potential threat until verified through Multi-Factor Authentication (MFA) and Role-Based Access Control (RBAC). This document outlines our comprehensive security protocols designed to meet and exceed healthcare facility infrastructure requirements while maintaining HIPAA Administrative Safeguards compliance.

✓ Zero-Knowledge Authentication ✓ AES-256 Encryption ✓ HIPAA Administrative Safeguards

1. Data Protection & Encryption

Encryption at Rest

All facility data, including ticket descriptions, vendor quotes, and infrastructure blueprints, are encrypted using AES-256 bit industry standards.

Encryption in Transit

All data moving between client devices and servers is forced through TLS 1.3(Transport Layer Security) to prevent interception.

Zero-Knowledge Passwords

We utilize Bcrypt with a Cost Factor of 12. No plain-text passwords exist in our system; not even a SuperAdmin can view or "recover" a user's password. Password reset requires authenticated token generation.

2. Communication Security

Asynchronous Mirroring

Every message is instantly mirrored to our HIPAA-compliant, Texas-based database.

Immutable Audit Logs (WORM)

Write Once, Read Many logic ensures communications cannot be edited or deleted, providing 100% accurate records for Joint Commission (TJC) audits.

Zero-PHI Policy

Platform is strictly for Non-Clinical Facility Operations. Pattern detection flags sensitive data (SSN, etc.) if accidentally entered.

3. Access Control & Governance

Control	Implementation	Status
Multi-Factor Authentication	TOTP-based MFA with Google Authenticator/Authy, mandatory for Admin/Supplier	ACTIVE
Role-Based Access (RBAC)	Department silos: Supply Chain, Facilities, Biomed, etc.	ACTIVE
Session Timeout	30-minute inactivity auto-logout for clinical terminals	ACTIVE
WORM Audit Logs	Immutable Write-Once-Read-Many logs with integrity hashing	ACTIVE
PHI Detection	Real-time scanning for SSN, MRN, and patient data patterns	ACTIVE
IP Allowlisting	Optional restriction to hospital network ranges	AVAILABLE

4. Infrastructure & Continuity

Data Residency

Texas-based primary infrastructure
US-South Multi-AZ deployment
State procurement law compliant

Disaster Recovery

Point-in-Time Recovery (PITR)
Off-site encrypted backups
99.9% uptime SLA

Technical Specifications

Authentication

Bcrypt Salting (Rounds: 12)

Encryption

AES-256-GCM / TLS 1.3

Audit Logging

WORM-compliant SQL Mirror

Infrastructure

US-South (Texas) Multi-AZ

AskIsaac.io

Texas C-Corporation

HIPAA Administrative Safeguards

Document generated: October 15, 2026

This document is confidential and intended for IT Security review purposes only.
For questions, contact: security@sterilemate.com