Multi-tenant row-level security
Every table carries row-level security scoped to the organization it belongs to. No table relies on an open, unscoped policy; access is checked at the database, not only in application code.
Security
Security your compliance review can verify.
This page lists the technical controls built and tested in Kept Count's code today, in the same terms your compliance team will use to check them.
Read alongside your questionnaire
Controls a reviewer can verify, not just take our word for.
Each item below runs in the codebase today and is exercised by automated tests your team can ask to see.
In the codebase today
Controls we can show, not just describe.
Each control runs in the platform and is exercised by automated tests, most recently reviewed in a September 2026 internal audit pass. They give your team a verified technical foundation, alongside the organizational and contractual work below, not instead of it.
Append-only audit trail
The audit log rejects edits and deletions, including by the table owner. Role changes, assignments, consent events, and clinical approvals are recorded with who acted, what changed, and when.
Multi-factor authentication
Covered deployments require time-based one-time-passcode multi-factor authentication, enforced at the database layer for tenant data and private documents, not only at the login screen.
Session timeouts
Authenticated sessions time out after a short idle period and expire on a hard absolute limit regardless of activity, then sign out and clear the workspace from view.
Restore drills
A database recovery drill runs in continuous integration: the application schema is backed up, dropped, and restored inside a disposable database, then checked row by row against the original, including that cross-tenant access is still denied after restore.
Migration CI
An automated guard compares every historical database migration file, byte for byte, against a reviewed baseline before a build is allowed to proceed, so a past migration cannot be silently rewritten.
Fresh-database replay in CI
Every migration is replayed in order against a brand-new, disposable database as part of continuous integration, then exercised with security tests, before that history is trusted.
Stated plainly
Protected health information moves only under a signed business associate agreement.
A business associate agreement is executed with each customer before any protected health information enters that customer's dedicated covered environment. Activation follows named approvals from your organization, never a switch Kept Count flips on its own. Your security questionnaire is answered item by item, with the control evidence behind each answer.
Read the full assurance roadmap on the trust centerSend us your security questionnaire.
We answer every question directly, with specifics, item by item.