Home / Legal
Security overview
Important: DMEDesk is currently a design preview and prototype. It is not HIPAA compliant, does not offer or sign a Business Associate Agreement (BAA), and must not be used to enter, upload or send protected health information (PHI) or any real patient data. All people, patients, facilities and records shown on this site are fictional.
Current status
DMEDesk is a prototype. This page lists only what is true today. It will be updated as controls are built and independently checked.
| Area | Status today |
|---|---|
| HIPAA compliance | Not compliant. Do not send PHI. |
| Business Associate Agreement | Not offered. See BAA status. |
| SOC 2 or other certification | None. No SOC 2 report or audit has been performed. |
| Penetration test | None performed. |
| Website transport | The marketing site and product tour pages are static files served over HTTPS (TLS) by Vercel, with a publicly trusted certificate for dmedesk.com. HTTP requests redirect to HTTPS. |
| Application database | The application under development uses Neon Postgres, with a row-level-security design intended to keep each company's records separate. It is not in use by any customer. In development; not yet tested end to end or independently verified. |
| Data in the product tour | Fictional only. The tour pages do not connect to a database. |
| Uptime or support SLA | None offered. |
What HIPAA would require of us
A DME supplier that bills electronically is generally a HIPAA covered entity. A software vendor that creates, receives, maintains or transmits PHI for it is a business associate, and the supplier must have a BAA in place first.[1] A cloud provider that stores ePHI is a business associate even if the data is encrypted and it holds no key.[3] Business associates are directly liable for parts of the HIPAA Rules, must report security incidents and breaches, and must flow the same obligations down to subcontractors.[1][2]
DMEDesk has not met these requirements. Until it does, it must not hold PHI.
Planned before any real patient data
These are planned steps, not current controls, and no date is set:
- Hosting, database and every subprocessor that would touch PHI under signed BAAs
- A documented HIPAA Security Rule risk analysis and risk management plan
- Written privacy, security, incident-response and breach-notification policies, with workforce training
- Verified tenant isolation, including automated tests that one company cannot read another's records
- Access controls with unique user accounts and multi-factor authentication for administrators, plus audit logging
- Backup and recovery procedures, then an independent security assessment
Reporting a security issue
If you think you have found a vulnerability, email darrenliu@mail.grokbot.com with "Security" in the subject. Please do not access data that is not yours, and do not run automated scans without permission. We will acknowledge good-faith reports.
Sources referenced
- HHS: Business Associates FAQs ↗ · checked November 9, 2026
- 45 CFR 164.504(e), business associate contracts (eCFR) ↗ · checked November 9, 2026
- HHS: Guidance on HIPAA & Cloud Computing ↗ · checked November 9, 2026