1. Scope & Applicability
Valorenode builds ReviewCore as multi-tenant review operations software. Some healthcare-adjacent customers may handle sensitive content in reviews. This page describes product safeguards and commercial readiness — it is not a claim that every workspace is a certified HIPAA deployment by default.
2. Business Associate Agreements (BAAs)
For customers that require a BAA before sending regulated data into the review pipeline, contact us via /contact. BAAs are handled as a commercial/legal process for qualifying plans — not an automatic self-serve toggle.
3. Tenant Isolation & Credentials
Workspace data access is fail-closed and organization-scoped. Integration credentials are stored as encrypted vault tokens. Payment profiles store processor tokens and last4/brand metadata only — never full PAN or CVV.
- Per-workspace tenant isolation for reviews, billing, and agent config
- Compliance-minded AI personas can flag PII-risk language in drafts
- Optional ENFORCE_GDPR_DATA_MASKING / ENFORCE_HIPAA_LOGGING flags for regulated environments
4. Audit Logging
When HIPAA-oriented logging flags are enabled in the environment, sensitive workspace actions are written to audit trails for operator review. Customers remain responsible for reviewing AI drafts before publication and for configuring their own retention obligations.
5. Incident Response
Security incidents should be reported via /contact or support@valorenode.com. We investigate and communicate with affected customers according to the applicable agreement. Do not treat this page as a substitute for a signed BAA or legal advice.