COMPLIANCE / BEFORE THE SOFTWARE

The risk lives
in the handoffs.

Sensitive data rarely stays in one app. It moves through the front desk, phones, inboxes, cloud tools, exports, vendors, backups and checkout. We map that route first, then build access, evidence and recovery around the way your team works.

See the everyday gaps ↓

Swipe to follow all five controls →

The exact HIPAA and PCI DSS scope depends on the organization, payment channel and implementation.

THE PLACES A POLICY MISSES

Compliance is what happens
on a normal Tuesday.

The expensive misses are usually ordinary: an old login, an export on a laptop, a card number pasted into chat, a vendor nobody reviewed, or a backup nobody has tried to restore. Open each row to see the control behind the moment.

HEALTH DATA

HIPAA / daily practice

For covered entities and business associates handling electronic protected health information.

01The account no one turned off

Shared credentials and yesterday’s permissions make it hard to say who reached a record. Give each person a unique identity, tie access to the work they perform, review it, and change or remove it when their role changes.

02The data outside the main app

Electronic protected health information can surface in forms, attachments, notification previews, exports, support tickets, diagnostic logs and mobile downloads. Map the whole route, minimize what each channel carries, and define retention and disposal.

03The cloud tool that “only stores it”

A cloud provider can be a business associate even when it stores encrypted ePHI and cannot decrypt it. Identify the vendor and subcontractor chain, put required agreements in place before data flows, and document who handles access, backup, return or destruction, and incident notice.

04The backup nobody restored

A backup file does not prove that the business can recover. Document backup, disaster recovery and emergency operations, then run and record restore tests against the systems the team actually needs.

05The device leaving service

Phones, laptops, drives, copier storage and portable media need a documented return, removal, reuse or destruction path before they leave the organization’s control.

06The incident with no owner

Decide who receives the alert, contains the event, preserves facts, assesses notification duties and contacts the right people. A federal 60-day breach-notification limit, when applicable, is an outside limit rather than a waiting period.

07The policy nobody practiced

Train against the real day: a lost phone, a misdirected attachment, an unusual export and a suspicious login. Record the training and evaluate controls again when systems, people or risks change.

PAYMENT DATA

PCI DSS / daily practice

For merchants and service providers across the payment channels and systems in scope.

01“Our processor handles PCI”

Outsourcing payment processing can reduce scope; it does not erase the merchant’s responsibility. Verify the provider for the services used, keep written responsibility terms, monitor its status, and know which controls remain with the business.

02The page before checkout

A compromised plugin, redirect or embedded payment page can change where a customer’s card goes. Protect merchant-controlled pages, accounts and code; keep scripts authorized; and watch for unauthorized changes.

03The card that entered a side channel

A phone order, recording, email, chat, ticket or spreadsheet can pull more systems into scope. Shape the workflow so card details stay with the processor. Card verification codes must not be stored after authorization, even when encrypted.

04The default login still working

Replace vendor defaults, remove unused accounts, issue unique identities and control remote or vendor access. A processor-hosted payment form does not make the merchant website’s authentication and patching irrelevant.

05The vendor responsibility gap

Keep one register of payment vendors, the services they provide, evidence and renewal dates, incident contacts, and which PCI DSS requirements each party performs.

06The wrong checklist

The right self-assessment questionnaire and reporting path depend on the complete payment setup. Confirm validation expectations with the acquirer or payment brand and use a Qualified Security Assessor where required.

WHAT YOU CAN ASK US TO SHOW

Controls leave
receipts.

The exact set is scoped per engagement. These are the practical records that make a control reviewable, teachable and easier to maintain.

Data-flow inventory

Where sensitive data enters, moves, rests and leaves.

Access matrix

Which roles may read, change, export or approve each record.

People changes

A joiner, role-change and departure checklist with ownership.

Vendor register

Agreements, responsibilities, evidence, renewal dates and contacts.

Control record

Encryption, logging, notification, retention and disposal decisions.

Recovery evidence

Backup coverage plus a dated restore test and what it proved.

Incident playbook

The first call, containment steps, evidence path and contact tree.

Payment scope summary

Hosted-payment design, remaining merchant controls and validation route.

WHAT SOFLOAI BUILDS

Technical and operational controls.

We map the data flow, define access, configure the application, document the handoffs, test recovery and make responsibilities visible. Deliverables and acceptance checks are agreed before work begins.

WHAT THE BUSINESS OWNS

Decisions, people and ongoing proof.

Your organization approves policy, trains its workforce, manages vendors, follows the controls and completes the validation or reporting that applies to it. We can prepare the system and evidence; we cannot transfer those duties away.

PRIMARY GUIDANCE

Read the source rules.

These links go to the agencies and standards body behind the guidance, rather than a marketing checklist.

SoFloAI designs and documents technical and operational controls. Obligations depend on your organization, data, payment channels, contracts and jurisdiction. HHS does not recognize or endorse private HIPAA certifications. PCI validation is determined by an acquirer or payment brand. SoFloAI does not represent itself as a Qualified Security Assessor and does not provide legal advice.

Map my data flow ↗

BUILD YOUR STARTING BRIEF

Start with the part
that should move.

Pick the closest direction. We’ll open the decisions inside it and turn your choices into a useful first brief.

Support@sofloai.solutions ↗

Start with the part that should move.

You don’t need the technical name. Pick the closest direction and we’ll open the decisions inside it.

MAKE IT SPECIFIC

Choose a direction first.

Choose up to three that feel closest. One is enough to begin.

Tell us what you would like to make happen.

LAST STEP

Where should we reach you?

Your choices are already the brief. Add the contact you actually answer.

Company nameYour nameEmail or mobileWhichever you actually answer.Website or social link Optional

That is all we need. We’ll gather the details together after we talk.

Where are you right now?

Required. Pick the closest answer.

Ready to executeLet’s scope it and move.Still exploringI’m comparing the direction.

Open in email instead ↗

Keep sensitive information, including patient records, payment details and passwords, out of this form. We’ll arrange a protected route when needed.

Review and send your inquiry in your email app. No mailing-list signup.

Your details are used to respond to your inquiry. Privacy details.