Trust
A certification tells you a vendor was audited once. It does not tell you what happens when a query forgets its tenant, when an administrator leaves, or when a payment gateway says yes and the money never arrives. This page answers those.
A query that loses its tenant scope returns nothing, not everything.
Row-level security is enforced in Postgres, so isolation does not depend on an application remembering to filter. Entitlement checks are SECURITY DEFINER functions with the scope baked in, and the failure mode of a mistake is an empty result rather than another tenant's data.
Licensing an app does not give anyone access to it.
An organization holds a licence — the ceiling. An administrator then grants that app to a named person. Opening it requires both, checked in the database at four independent points including the moment a single-use handoff ticket is minted. Revoking a person is one row, and it takes effect at the next check.
Records cannot be revised after the fact.
Who acted, on what, when, and what the system answered — including denials, which are the entries that matter in an investigation. Update and delete are revoked at the database level rather than merely unused, and the log is exportable for your own retention.
An invoice says Submitted until money is confirmed to have moved.
A payment gateway returning success means it accepted the request, not that funds arrived. Invoices reach Paid only when settlement is confirmed against the processor by a separate reconciliation pass. This matters more with ACH, where a return can arrive days after a card would have been called paid.
Moving between products does not pass around a reusable credential.
Signing in to one ARYX product from another mints an opaque ticket that is valid once, for ninety seconds, bound to the destination app. It is consumed atomically, so it cannot be replayed, and it is never written to the audit log it triggers.
An ordinary member cannot enumerate the organization.
The team directory — email addresses, last sign-in, which colleagues hold which software — is an administrative read, restricted to owners and admins and paginated. Ordinary members see names, because that is what collaboration needs.
Compliance posture
An undated badge in a grid reads as an attestation. Here is exactly what we hold, what we are working toward, and what we have chosen not to pursue.
| Item | Status | Detail |
|---|---|---|
| HIPAA Business Associate Agreement | Executed | With every tenant processing PHI, under a documented shared-responsibility model. |
| Tenant isolation, grants, audit | In place | Enforced in the database today, and inspectable under NDA. |
| SOC 2 Type I | Targeted May 2027 | In readiness now. The control set above is most of the evidence. |
| SOC 2 Type II | Window follows Type I | Observation period begins once Type I is issued. |
| HITRUST | Not pursued | We do not hold it and do not claim it. Ask us and we will say so. |
We will walk your security team through the control set above under NDA — including the schema that enforces it — before you commit to anything. Our full policy framework covers data processing, retention and portability, incident response, access control, and audit evidence.
Pilot customers onboard in Q3 2026 with 50% launch pricing. Commercial licensing opens November 1, 2026. Let's talk.