A technical overview of Travi's security posture — covering network topology, data protection, threat model, access controls, and compliance certifications. Designed to support hospital IT security reviews and investor due diligence.
| Threat | Likelihood | Control | Status |
|---|---|---|---|
| PHI data breach | HIGH | AES-256 field-level encryption, PHI vault isolation, no PHI in logs, BAA with all vendors | MITIGATED |
| API injection / SSRF | MEDIUM | WAF with OWASP ruleset, input validation at API Gateway, parameterized queries, SSRF blocklist | MITIGATED |
| LLM prompt injection | MEDIUM | Structured output schema enforcement, 7-gate post-processing validation, human review flag for anomalous outputs | MITIGATED |
| Credential compromise | MEDIUM | AWS Secrets Manager with auto-rotation, no hardcoded secrets, MFA enforced for all admin access, least-privilege IAM | MITIGATED |
| DDoS / availability | LOW | AWS Shield Standard + Advanced, CloudFront CDN, auto-scaling ECS Fargate, rate limiting at API Gateway | MITIGATED |
| Insider threat | LOW | Role-based access control, immutable audit log, no single person can access PHI vault + audit logs simultaneously, background checks | MITIGATED |
| Third-party vendor breach | MEDIUM | BAA with all PHI-touching vendors (Twilio, OpenAI, AWS), annual vendor security review, data minimization — vendors receive de-identified data only | MONITORED |
SMS only. No login, no account. Patient token is pseudonymous — no PII in the messaging layer. Consent captured via SMS reply.
SSO via hospital IdP (SAML 2.0). Read access to assigned patient cohort only. Cannot access PHI vault directly. MFA required.
Receives alerts in EHR in-basket only. No Travi login required. All interactions logged via FHIR Communication resource write-back.
Read-only analytics API access. Can query aggregate outcomes and HRRP metrics. No access to individual patient records. Scoped JWT tokens.
Zero standing access to production PHI. Break-glass access requires dual approval + is logged immutably. Prod access reviewed quarterly.
Read-only access to audit logs and access reports. Can trigger access reviews. Cannot modify data. Separate audit-only IAM role.
Annual third-party penetration test conducted by a CREST-certified firm. Most recent test: Q2 2026 — zero critical findings, two medium findings (both remediated within 14 days). Continuous vulnerability scanning via AWS Inspector and Snyk on all container images and dependencies. CVE patching SLA: critical within 24h, high within 7 days.
See also: FHIR R4 Data Flow — for how PHI moves through the pipeline, and Product Cycle Diagram — for the end-to-end episode execution flow.