Trust Center - Medera

Medera operates a HIPAA-grade, 42 CFR Part 2-aware platform with explicit controls at every layer of the request path. Every tenant runs in a Row-Level-Security-isolated database, all PHI is encrypted with AES-256, and every PHI access generates an immutable audit event chained with Merkle integrity checkpoints.

HIPAA

Security and Privacy Rule controls under 45 CFR §164.

42 CFR Part 2

Substance use disorder data with explicit consent + re-disclosure.

BAA / DPA

Business Associate Agreement + Data Processing Addendum.

Sub-processors

Current sub-processor list.

Data Residency

US, EU, and customer-VPC options.

Encryption

AES-256 at rest, TLS 1.3 in transit.

Audit Logging

WORM audit + Merkle integrity.

Row-Level Security

Tenant isolation at the database layer.

Certification posture

Control	Status
HIPAA Security Rule	Operating, externally audited
HIPAA Privacy Rule	Operating
42 CFR Part 2	Operating
SOC 2 Type II	In audit
HITRUST	Roadmapped Q4 2026
ISO 27001	Roadmapped 2027	Request the current trust bundle at trust.medera.info.

What’s next

HIPAA controls

Section-by-section implementation.

42 CFR Part 2

SUD data controls.

Encryption

Keys, rotation, KMS.

Audit Logging

WORM audit details.

HIPAA Compliance

HIPAA

42 CFR Part 2

BAA / DPA

Sub-processors

Data Residency

Encryption

Audit Logging

Row-Level Security

​Certification posture

​What’s next

HIPAA controls

42 CFR Part 2

Encryption

Audit Logging

Certification posture

What’s next