Security Practices

NeuralRev implements defense-in-depth security controls designed for healthcare data protection and regulatory compliance.

Authentication

Password Requirements

All user passwords must meet the following criteria:

• Minimum 8 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one digit
• At least one special character
• Cannot reuse recent passwords (history enforcement)

Two-Factor Authentication (2FA)

NeuralRev requires two-factor authentication for full platform access.

Setup process:

1. Navigate to Profile > Security
2. Click Enable 2FA
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
4. Enter the 6-digit verification code to confirm setup
5. Save your recovery codes in a secure location

Recovery codes are one-time-use backup codes that allow access if you lose your authenticator device. Each account receives a set of recovery codes during 2FA setup. Once used, a code cannot be reused. Admins can reset 2FA for team members if needed.

Session Security

Active sessions are managed with the following controls:

When the concurrent session limit is reached, the oldest session is automatically revoked.

Account Lockout

After multiple failed login attempts, the account is temporarily locked to prevent brute-force attacks. The lockout duration is configurable by administrators.

---

Authorization

Role-Based Access Control (RBAC)

NeuralRev uses granular role-based permissions with three default roles:

Permission Granularity

The permission system provides fine-grained control over individual resources and actions. Permissions are organized by resource type (patients, encounters, claims, etc.) and action (read, create, update, delete).

Feature Flags

Workspace-level feature flags control which capabilities are available. This allows organizations to enable features incrementally or restrict access to specific workflows.

---

API Key Security

API keys provide programmatic access to the Integration API.

Key Management

• Keys are prefixed with nrev_ for easy identification
• The full key is displayed only once at creation time
• Keys are stored irreversibly hashed (never in plaintext)
• Each key is scoped to a specific workspace
• Keys can be activated, deactivated, or permanently deleted

Best Practices

• Rotate keys periodically (every 90 days recommended)
• Use separate keys for different integration systems
• Monitor key usage through audit logs
• Immediately deactivate compromised keys
• Never embed keys in client-side code or version control

---

Webhook Security

Outbound webhooks are secured with cryptographic signatures.

Signature Verification

Every webhook delivery includes:

• X-Webhook-Signature — Cryptographic hash of the request body
• X-Webhook-Timestamp — Unix timestamp of when the webhook was sent

Verification process:

1. Extract the timestamp and signature from headers
2. Concatenate the timestamp and request body: {timestamp}.{body}
3. Compute HMAC-SHA256 using your webhook secret (prefixed with whsec_)
4. Compare the computed signature with the received signature
5. Verify the timestamp is within an acceptable window (e.g., 5 minutes)

Secret Management

• Webhook secrets are prefixed with whsec_ for identification
• Secrets can be rotated without downtime
• Previous secrets remain valid for a grace period during rotation

---

Data Protection

Encryption in Transit

All data transmitted between clients and the NeuralRev API is encrypted using TLS 1.2+. This includes:

• Browser-to-API communication
• Clearinghouse data transmission
• Webhook deliveries
• EMR integration API calls

Encryption at Rest

All sensitive data is encrypted at rest:

• Database — AES-256 encrypted storage
• Credentials — One-way hashed using industry-standard algorithms
• Secrets — Encrypted with authenticated encryption
• Documents — Server-side encrypted storage

Data Isolation

Multi-tenant data isolation is enforced at multiple levels:

1. Database layer — Automatic tenant/workspace filtering on all queries
2. Application layer — Middleware validates tenant context on every request
3. Storage layer — Document paths scoped by tenant and workspace

---

Audit Logging

NeuralRev maintains an immutable audit trail of all significant actions.

What Is Logged

• User authentication events (login, logout, 2FA validation)
• Data access (read operations on patient records)
• Data modifications (create, update, delete on all entities)
• Administrative actions (member management, role changes, feature toggles)
• Integration events (API key usage, webhook deliveries)
• External API calls (clearinghouse submissions)

Audit Log Properties

Each audit entry includes:

Immutability

Audit logs are protected against tampering:

• Records cannot be modified or deleted once written
• Cryptographic hashes allow verification of record integrity
• Logs are retained for the duration required by compliance policies

---

Rate Limiting

Rate limiting is enforced to protect the platform from abuse:

• A global per-IP rate limit applies to all API requests
• Stricter limits apply to sensitive endpoints (login, password reset, 2FA)
• When rate limited, the API returns HTTP 429 with a retry indicator

---

Security Headers

All API responses include standard security headers:

---

CSRF Protection

Cross-Site Request Forgery protection is enforced for all state-changing operations when using cookie-based authentication. API key-authenticated requests (Integration API) are exempt from CSRF checks as they are server-to-server only.

---

Access Request Management

NeuralRev enforces a formal access request and approval process for all privileged systems. This ensures compliance with SOC 2 (CC6.1–CC6.3) and HIPAA (§164.312) requirements for access control and authorization.

Request Process

All employees must submit a formal access request before receiving access to any critical or privileged system:

Covered Systems

The following categories of systems require formal access requests:

• Cloud Infrastructure — AWS Console, GCP, Azure, and related cloud services
• HRIS — BambooHR, Gusto, or equivalent human resources platforms
• CI/CD — GitHub Actions, Bitbucket Pipelines, deployment platforms
• Database — Production and staging database access
• Other — Any system containing sensitive data or PHI

Access Levels

Approval Authority

• Standard access (Viewer/Editor) — IT Manager or Department Head
• Privileged access (Admin) — IT Director or CISO
• PHI-related access — Requires additional HIPAA Officer approval

Separation of duties is enforced: the requester cannot approve their own request.

Access Reviews

• Quarterly — Review of all admin-level access
• Semi-annually — Review of all active access grants
• On termination — Immediate revocation of all access upon employee departure
• On role change — Review and adjustment of access when employees change roles

Revocation

Access is revoked when an employee leaves the organization, changes roles, when a periodic review determines access is no longer justified, or when a security incident necessitates immediate revocation. All revocations are logged with the reason, actor, and timestamp.

---

Compliance Summary

Compliance Mapping