> ## Documentation Index
> Fetch the complete documentation index at: https://docs.medera.info/llms.txt
> Use this file to discover all available pages before exploring further.
# Trust Center
> Medera's HIPAA + 42 CFR Part 2 compliance program.
Medera operates a HIPAA-grade, 42 CFR Part 2-aware platform with explicit controls at every layer of the request path. Every tenant runs in a Row-Level-Security-isolated database, all PHI is encrypted with AES-256, and every PHI access generates an immutable audit event chained with Merkle integrity checkpoints.
Security and Privacy Rule controls under 45 CFR ยง164.
Substance use disorder data with explicit consent + re-disclosure.
Business Associate Agreement + Data Processing Addendum.
Current sub-processor list.
US, EU, and customer-VPC options.
AES-256 at rest, TLS 1.3 in transit.
WORM audit + Merkle integrity.
Tenant isolation at the database layer.
## Certification posture
| Control | Status | |
| :------------------ | :---------------------------- | ----------------------------------------------------------------------------------- |
| HIPAA Security Rule | Operating, externally audited | |
| HIPAA Privacy Rule | Operating | |
| 42 CFR Part 2 | Operating | |
| SOC 2 Type II | In audit | |
| HITRUST | Roadmapped Q4 2026 | |
| ISO 27001 | Roadmapped 2027 | Request the current trust bundle at [trust.medera.info](https://trust.medera.info). |
***
## What's next
Section-by-section implementation.
SUD data controls.
Keys, rotation, KMS.
WORM audit details.