HIPAA, PIPEDA, and SOC 2 ready architecture.

MedXL Practice is engineered as a compliance-ready multi-tenant OS: tenant isolation, RBAC, MFA hooks, encryption in transit, audit logs on mutating requests, and activity tracking.

• Row-level tenant scoping on every clinical and financial record
• JWT sessions, bcrypt password hashing, refresh-token path
• Immutable audit trail (who, what, when, IP, user agent)
• FHIR R4 gateway for hospitals, labs, and pharmacies
• S3-compatible document storage and PostgreSQL backups

Certification requires a signed BAA and a production security program. This platform ships the technical controls; legal coverage is configured per tenant.