Trust Center
swiftEVV is one platform for home care agencies, scheduling, clinical charting, QA and Medicaid billing. That means other people’s health data, and we act like it: every agency is walled off from every other, all data is encrypted in transit and at rest, access to patient records is logged, and this page only says things that are true.
Last reviewed October 10, 2026. Questions or anything that looks wrong: support@swiftevv.com
Compliance
HIPAA
swiftEVV operates a HIPAA security program as a business associate: the technical safeguards listed below are implemented and tested, and our administrative policies (security, retention, incident response, disaster recovery, vendor management) were adopted in October 2026. Business Associate Agreements with our infrastructure vendors are being finalized; we will state plainly here when they are all executed. There is no official “HIPAA certification”, for anyone, so we show you the controls instead.
SOC 2
Planned. Our controls are modeled on the SOC 2 Trust Services Criteria from day one so that a formal Type II examination is a step, not a rebuild. We have not yet engaged an auditor, and we won’t imply otherwise.
Controls
Everything listed is implemented and in production today.
Product security
- All traffic encrypted in transit (TLS, HSTS enforced)
- Data encrypted at rest (AES-256, managed by our database provider)
- Every agency’s data isolated by design, cross-agency requests find nothing
- Role-based access: admins, supervisors, office staff and nurses each see only their job
- Editing a signed clinical document voids its signatures, visibly
- Password policy enforced in code on every path that sets a password
- Repeated failed logins are locked out; sessions expire after 24 hours
- Security headers set application-wide (HSTS, X-Frame-Options, nosniff)
Monitoring & accountability
- PHI access is logged, who viewed or printed what, and when
- Platform-staff "view as" access is separately logged
- Audit logs are retained for 6 years, independent of the data they describe
- Dependencies scanned weekly for vulnerabilities; critical fixes within 14 days
- Live system health published at /status
Data lifecycle
- Retention tiers by plan; clinical records kept for the life of the customer relationship
- When an agency leaves, every record it owns is deleted in one audited, irreversible operation
- LTSS portal credentials are used per-request and never stored
- No customer data is ever sold or shared with third parties
Internal procedures
- Written security policies adopted October 2026, reviewed annually
- Backup & disaster recovery plan with point-in-time database restore, tested annually
- Incident response plan with HIPAA business-associate notification timelines
- Additive-only database migrations, destructive changes are prohibited
- Every production change is versioned, built, and type-checked before deploy; instant rollback
- Vendor inventory with annual review; PHI vendors require a BAA before data reaches them
Infrastructure
swiftEVV runs on Vercel (application) and Neon (Postgres database), both SOC 2 Type II audited providers, with source code on GitHub and payments through Stripe (which never sees patient data). We run no servers of our own, so physical data-center security, network hardware and OS patching are covered by our providers’ audited programs, and we inherit their controls rather than imitating them.
Resources
System status
Live component health, refreshed continuously
Anonymous reporting
Report a concern, no account, no identity stored
Privacy Policy & Terms
How data is handled, in plain language, and the agreement behind the service
Security contact
support@swiftevv.com, policies available to customers on request