> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Center

> Security, privacy, and compliance posture at Denialbase. Built for healthcare from day one.

<Note>
  Denialbase handles Protected Health Information (PHI) for covered entities under HIPAA. This Trust Center documents how we protect it — what's live today, what's in progress, and what's on the roadmap.
</Note>

## Security at a glance

<CardGroup cols={2}>
  <Card title="Encryption" icon="lock" href="/trust/encryption">
    AES-256 at rest with customer-managed encryption keys (CMEK) on all primary data stores. TLS 1.2+ in transit. Column-level PHI encryption on top.
  </Card>

  <Card title="Authentication" icon="fingerprint" href="/trust/authentication">
    Passwords + TOTP or passkeys. Google OAuth 2.1. Account lockout, device-based rate limiting, httpOnly session cookies.
  </Card>

  <Card title="Network" icon="shield" href="/trust/network-security">
    Cloud Armor WAF with OWASP Core Rule Set v3.3, private VPC, Workload Identity Federation for CI/CD (no long-lived keys).
  </Card>

  <Card title="Audit Logging" icon="clipboard-list" href="/trust/audit-logging">
    Structured HIPAA audit log pipeline. Every PHI access, mutation, and authentication event recorded with 6-year retention.
  </Card>
</CardGroup>

## Compliance posture

<Info>
  Denialbase is **HIPAA-ready** (BAA before any PHI moves) and pursuing **SOC 2 Type I** and **ISO 27001** certifications. We are not formally HIPAA-certified — see [SOC 2 / ISO 27001 readiness](/trust/soc2-iso27001) for the current readiness snapshot and live remediation tracker.
</Info>

<CardGroup cols={2}>
  <Card title="HIPAA" icon="file-medical" href="/trust/hipaa">
    Administrative, physical, and technical safeguards. PHI minimization. Audit trails. Access controls.
  </Card>

  <Card title="SOC 2 / ISO 27001" icon="certificate" href="/trust/soc2-iso27001">
    Current readiness, gaps, and target certification dates. Updated quarterly.
  </Card>

  <Card title="Statement of Applicability" icon="list-check" href="/trust/statement-of-applicability">
    ISO 27001:2022 Annex A control mapping — 93 applicable, 4 N/A, per-control status + evidence.
  </Card>

  <Card title="BAAs" icon="file-contract" href="/trust/baa">
    How to request a Business Associate Agreement. Signed BAAs with our subprocessors.
  </Card>

  <Card title="Subprocessors" icon="server" href="/trust/subprocessors">
    Full list of infrastructure and service providers with data residency and BAA status.
  </Card>
</CardGroup>

## Operations

<CardGroup cols={2}>
  <Card title="Incident Response" icon="siren" href="/trust/incident-response">
    How we detect, respond to, and communicate about security incidents. On-call rotation + severity matrix.
  </Card>

  <Card title="Disaster Recovery" icon="rotate-left" href="/trust/disaster-recovery">
    Backup strategy, RPO/RTO targets, and tested restore procedures.
  </Card>

  <Card title="Business Continuity" icon="life-ring" href="/trust/business-continuity">
    How Denialbase continues serving customers through technical, operational, and vendor disruptions.
  </Card>

  <Card title="Vulnerability Management" icon="bug" href="/trust/vulnerability-management">
    SAST, dependency scanning, SLAs, and penetration testing cadence.
  </Card>

  <Card title="Change Management" icon="git-branch" href="/trust/change-management">
    Code review, CI/CD security gates, deployment approvals.
  </Card>
</CardGroup>

## Governance

<CardGroup cols={2}>
  <Card title="Internal audit" icon="clipboard-check" href="/trust/internal-audit">
    Independent review of the ISMS — audit program, methodology, cadence.
  </Card>

  <Card title="Management review" icon="chart-simple" href="/trust/management-review">
    Quarterly ISMS effectiveness review by executive leadership.
  </Card>

  <Card title="HR security" icon="user-tie" href="/trust/hr-security">
    Workforce security — screening, onboarding, training, offboarding.
  </Card>

  <Card title="Security awareness" icon="graduation-cap" href="/trust/security-awareness">
    Annual training program, phishing simulation, role-specific modules.
  </Card>
</CardGroup>

## Policies

<CardGroup cols={2}>
  <Card title="Information Security Policy" icon="book" href="/trust/information-security-policy">
    The top-level policy governing all security controls at Denialbase.
  </Card>

  <Card title="Acceptable Use Policy" icon="user-shield" href="/trust/acceptable-use-policy">
    Rules for Denialbase personnel using company systems.
  </Card>

  <Card title="Access Control Policy" icon="lock" href="/trust/access-control-policy">
    Who gets access to what, for how long, and how we verify it stays correct.
  </Card>

  <Card title="Cryptography Policy" icon="key" href="/trust/cryptography-policy">
    Approved algorithms, key management, rotation cadence.
  </Card>

  <Card title="Data Classification" icon="folder-tree" href="/trust/data-classification-policy">
    Four classifications (Restricted PHI, Confidential, Internal, Public) with handling rules.
  </Card>

  <Card title="Change Management Policy" icon="code-branch" href="/trust/change-management-policy">
    Formal policy governing all changes to Denialbase systems.
  </Card>

  <Card title="Vendor Management" icon="handshake" href="/trust/vendor-management">
    Vendor risk assessment, subprocessor governance, and BAA tracking.
  </Card>

  <Card title="Risk Management" icon="triangle-exclamation" href="/trust/risk-register">
    Risk methodology (5×5 L×I) and the live register of tracked risks.
  </Card>
</CardGroup>

## Report a vulnerability

<Card title="security@denialbase.com" icon="envelope" href="mailto:security@denialbase.com">
  We follow coordinated disclosure. Report suspected vulnerabilities to `security@denialbase.com` — acknowledgement within 2 business days. PGP key available on request.
</Card>

## Stay informed

<Card title="Status page" icon="heart-pulse" href="https://status.denialbase.com">
  Real-time availability, incident history, and planned maintenance windows.
</Card>