Compliance & Security Posture
RadiantScanAI implements the OmniAlera World-Class Platform Standard. The matrix below maps each control to HIPAA, GDPR, SOC 2, and the African data-protection regimes (NDPA/POPIA/DPA). This is a readiness summary and preparatory guidance, not legal advice or a certification; SOC 2 Type II and jurisdictional registrations require independent third parties.
HIPAA
Technical & administrative safeguards implemented; BAA offered. Applies to US patient data.
GDPR
Controller/processor model, DPIA, DPA, consent, and data-subject-rights workflow in place.
SOC 2
Control set mapped and evidenced; Type II attestation requires an independent auditor over an observation window.
NDPA / POPIA / DPA
African data-protection overlay with in-country residency; validate registration per jurisdiction.
Controls matrix
| Area | Control implemented | HIPAA | GDPR | SOC 2 | NDPA |
|---|---|---|---|---|---|
| Access control | bcrypt(12) + JWT, 11-role RBAC enforced in UI and API, account lockout | §164.312(a) | Art. 32 | CC6.1 | Part V |
| Audit controls | Append-only audit log of logins, role changes, exports, EHR queries; operator status view | §164.312(b) | Art. 30 | CC7.2 | s.24 |
| Transmission security | HTTPS/HSTS, strict CSP, X-Frame-Options DENY, nosniff, Referrer-Policy | §164.312(e) | Art. 32 | CC6.7 | s.39 |
| Integrity | Signed tokens verified server-side; typed schema + migrations; secret scanning in CI | §164.312(c) | Art. 5(1)(f) | CC6.8 | s.39 |
| Minimisation / de-id | Identifiers stripped before AI prompts; reports store de-identified references only | Safe Harbor | Art. 5(1)(c) | CC6.1 | s.25 |
| Consent & lawful basis | Consent model records purpose, lawful basis, timestamp; revocable | Authorization | Art. 6/9 | P-series | s.26 |
| Breach management | Documented breach-response process + register; secret rotation runbook | §164.400 | Art. 33/34 | CC7.4 | s.40 |
| Vendor management | Data Processing Agreement pack with cross-border clauses; sub-processor list | BAA | Art. 28 | CC9.2 | DPA |
| Data residency | Per-tenant in-country residency commitment for African markets | n/a | Ch. V | CC6.1 | Residency |
| Availability | Demo→live graceful fallback; health probe; CI blocking gates before deploy | §164.308(a)(7) | Art. 32 | A1.2 | s.39 |
Governance pack
Reusable templates ship in docs/governance/: assurance packet, DPIA, DPA, MOU, consent & data-protection policy, pilot plan, and breach-response process. See CERTIFICATION.md for the evidence-mapped definition of done.