Six things your IT and compliance folks will ask about, all running in production today.
Every account needs a passkey or authenticator. No exceptions, no off switch.
Data is isolated per organization, enforced in code. Blocked attempts are recorded.
Sign-ins, sensitive views and changes: append-only, searchable, exportable.
Off-site within ~1 second, 30-day point-in-time restore, auto-validated daily.
HTTPS-only with HSTS and DNSSEC; sensitive fields encrypted at rest.
CSP, CSRF, clickjacking and SSRF protection on every request.
Chordae is a workforce tool and is PHI-free by design: no patient information belongs in it. If your organization needs PHI inside Chordae, a Business Associate Agreement can be arranged on special request, case by case.
