Trust
A certification tells you a vendor was audited once. It does not tell you what happens when a query forgets its tenant, when an administrator leaves, or when a payment gateway says yes and the money never arrives. This page answers those.
Tenants are separated by Postgres row-level security, not by an interface remembering to filter.
That is the design in every ARYX product. We are partway through a policy-by-policy review of tenant isolation across the suite and are fixing what it finds before we describe isolation as complete. Ask us where each product stands before you send PHI; we will show you the policies under NDA.
A licence is the ceiling, not a key: each person needs their own grant.
An organization holds a licence. An administrator then grants that app to a named person, and ARYX Accounts checks both before it mints the single-use ticket that opens the app. Revoking a person is one row. Some products still accept an older sign-in path that does not check the per-person grant; we are retiring it and will tell you which ones on request.
Records cannot be revised after the fact.
Who acted, on what, when, and what the system answered — including denials, which are the entries that matter in an investigation. Update and delete are revoked at the database level rather than merely unused, and the log is exportable for your own retention.
An invoice says Submitted until money is confirmed to have moved.
A payment gateway returning success means it accepted the request, not that funds arrived. Invoices reach Paid only when settlement is confirmed against the processor by a separate reconciliation pass. This matters more with ACH, where a return can arrive days after a card would have been called paid.
Opening one product from another through ARYX Accounts uses a ticket that works once.
The ticket is opaque, valid once, for ninety seconds, and bound to the destination app. It is consumed atomically, so it cannot be replayed, and it is never written to the audit log it triggers. Some older integrations still accept a legacy hand-off that passes a session token while they move to tickets.
An ordinary member cannot enumerate the organization.
The team directory — email addresses, last sign-in, which colleagues hold which software — is an administrative read, restricted to owners and admins and paginated. Ordinary members see names, because that is what collaboration needs.
Compliance posture
An undated badge in a grid reads as an attestation. Here is exactly what we hold, what we are working toward, and what we have chosen not to pursue.
| Item | Status | Detail |
|---|---|---|
| HIPAA Business Associate Agreement | In progress | Our BAA is pending counsel review. Ask us for its status before you send PHI. |
| Tenant isolation, grants, audit | Under review | Built on database row-level security. A policy-by-policy review across every product is in progress; ask us where each product stands. Inspectable under NDA. |
| SOC 2 Type I | Planned | Type I targeted for May 2027. No audit firm is engaged yet; ask us where it stands. |
| SOC 2 Type II | Window follows Type I | Observation period begins once Type I is issued. |
| HITRUST | Not pursued | We do not hold it and do not claim it. Ask us and we will say so. |
We will walk your security team through the control set above under NDA — including the schema that enforces it — before you commit to anything. Our policy framework, now pending counsel review, covers data processing, retention and portability, incident response, access control, and audit evidence.
Create an Accounts login, name the organization, and subscribe to the apps you need. CRM and AdvisorIQ start with a 14-day trial. EnrollFlow is sized with you.