Security & PHI

Built to carry PHI — and open about exactly how

MessageFoundry ships a genuinely-built identity, access-control, and audit core — enforced in code, not just documented — and runs in a controlled, fail-closed posture. Just as important for a healthcare buyer: the security story is open. You can download a posture summary that rates every control by what's actually enforced, and request the full code-grounded review.

Download the posture summary (PDF) Verify it yourself →

Built & enforced today

A real access-control and audit core

These controls are implemented and enforced in the running engine — among the stronger access-control stories in this product category for a pre-1.0 product.

Authentication, fail-closed

Local accounts with argon2id password hashing and account lockout, plus Active Directory over LDAPS. The engine refuses to serve unauthenticated requests off loopback, and denies access when no auth is configured. (Kerberos / Windows SSO is experimental; MFA is on the roadmap.)

Deny-by-default RBAC

Role-based access control with fixed built-in roles, enforced on every engine and admin route, denying anything not explicitly granted — including per-channel data-scope confinement, so a user only ever sees the interfaces they're entitled to.

Sessions you can revoke

Opaque, server-side session tokens with idle and absolute timeouts and immediate revocation — no long-lived bearer secrets floating around.

Tamper-evident audit log

A user-attributed, hash-chained audit log records who viewed, replayed, or acted on PHI — with a verification command that detects out-of-band edits. (Tamper-evidence, not prevention; integrity still rests on host/file access controls.)

Encryption at rest

Message bodies are encrypted with AES-256-GCM when a store-encryption key is set. We recommend pairing it with full-disk/volume encryption (BitLocker, LUKS) so everything at rest is covered.

Nothing silently dropped

Every received message is persisted with a recorded disposition before it's acknowledged — so your message counts always reflect the truth, and there's no quiet data loss to discover later.

Deployment posture

Designed for a controlled, fail-closed deployment

Today's supported posture is a single, controlled host: the API binds to 127.0.0.1 and requires authentication, and the trust boundary is that localhost API and the host itself.

Loopback by default — the API isn't exposed to the network; the admin console attaches over localhost.
Some protections are operator preconditions — set the at-rest encryption key, enable full-disk encryption, lock down config and spill directories, and treat backups as PHI. We document exactly which.
Least-privilege service — runs headless as a service account; config authors run trusted in-process code (the documented extension model).
No surprises — the engine fails closed rather than falling open when something isn't configured.

Before network exposure

What's on the roadmap — disclosed, not hidden

A few things you'd need before exposing PHI over a network are not built yet. We disclose them plainly; until they land, keep the engine on localhost or behind your own TLS proxy.

TLS everywhere planned

The API and MLLP are plaintext today (loopback posture). MLLP-over-TLS and API TLS are required before any off-host exposure. AD (LDAPS) and the SQL Server backend already use TLS.

MFA & allow-listing planned

Multi-factor authentication and an outbound destination allow-list — so a message can only ever be sent to a pre-approved endpoint.

Data lifecycle planned

Retention / purge enforcement, centralized log redaction, and a de-identification framework — so PHI doesn't accumulate indefinitely and never leaks into logs.

Verify, don't trust

An open security posture you can check yourself

The strongest thing we can offer a CISO isn't a claim — it's the receipts. We publish a security & PHI posture summary — controls, compliance alignment, and deployment requirements, rated by what's enforced in code, not what's documented, gaps included — and a full, code-grounded control-by-control review is available on request.

Download the posture summary (PDF)

The summary covers our controls, compliance alignment, and deployment requirements. The full code-grounded review is available on request.

Source-available — AGPL-licensed; audit the code, fork it, run it on your own terms.
Code-grounded review — every control rated by what's enforced, with the gaps named.
PHI-safe AI — the in-editor assistant sends only code, never message bodies, under a central policy.
Honest by default — the project's own docs disclose what isn't built; we'd rather you find out here than in procurement.

Evaluating MessageFoundry for PHI?

Start with the code and the security review — then bring us your questions.

Get started Take the product tour →