Healthcare
Keep patient data safe and every change accountable.
Health privacy laws hold you responsible for who can reach patient data and for showing what you did about it. ACSE keeps the cloud systems that hold that data correctly configured, fixes what drifts through your own code, and never takes the data out of your account to do it.
Patient data stays put
ACSE works inside your account. Only shapes and counts reach its control plane, never names or contents.
Fewer exposed data stores
Public access, missing encryption and open paths to storage are found and fixed through reviewed code.
Proof for privacy reviews
Each change carries its approval, testing and verification, in a record your auditors can check.
Privacy by architecture
The data never leaves your cloud
The ACSE runtime runs in your account and reads configuration, not the records stored in your databases or buckets. What it sends to the control plane is classified by a deny-by-default registry and limited to shapes and counts.
If you turn on ACSE’s optional AI, it runs on the model service in your own account and sees sanitized metadata only.
Projections carry shapes and counts. The schema rejects resource names, ARNs and ids, so they cannot be sent by mistake.
The risk graph is built in your account. ACSE sees the shape of the path, not who or what is on it.
There are no long-lived keys. Connections use workload identity federation and read-only roles you create.
Evidence is written to append-only storage in your account. ACSE can show and verify it, but cannot change it.
Decisions are delivered back to your account and appended to the chain before they count.
Common fixes
Where misconfigurations hurt most
Public storage
Buckets holding exports, images or reports opened to the internet, closed with a public access block.
Encryption at rest
Storage without default encryption, fixed in the Terraform that defines it.
Versioning and recovery
Storage without versioning, so deleted or overwritten records can’t be recovered.
Accountability
Every change, signed and sealed
Each fix is approved by a person with step-up MFA, never its author. The decision, the merge and the verification are chained into append-only storage in your account.
Your privacy office and auditors can verify the chain offline, without trusting ACSE.
Questions
What people ask us
Does ACSE ship a framework pack for health privacy law?
Not as a shipped pack. You can map your obligations as a custom framework on ACSE’s checks. ISO 27001, SOC 2 and NIST 800-53 ship as signed packs.
Does ACSE scan the contents of our data stores?
No. ACSE reads configuration, such as whether a bucket is public or encrypted. It does not classify or read your data.
Can we keep the control plane in our country?
The control plane runs in a region chosen per deployment, and changing it takes two admins. Your runtime and evidence always stay in your own account.
Keep reading
Related
Data residency
ACSE runs its runtime and evidence store in your own account. Only shapes and counts reach its control plane, and changing region takes two admins.
ReadTrustData boundary
ACSE runs in your account and sends only shapes and counts. Names, ids and credentials stay with you, and a deny-by-default registry governs what leaves.
ReadFrameworksNIST SP 800-53
ACSE maps cloud checks to the NIST SP 800-53 Rev. 5 technical controls it tracks across ten families, and shows each control as evaluated or manual.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.