Security & HIPAA Readiness

Star Steps · Last updated 2 August 2026

What this page is. Most vendors write "HIPAA compliant" and stop. HIPAA is not a feature you can switch on — it is a set of safeguards plus a signed agreement, and it only applies at all when a covered entity is involved. This page lists the specific controls we have built, the ones that require a signed agreement to become binding, and the things we have not finished. If you are evaluating Star Steps for a clinic or district, this is the page to send to your compliance reviewer.

When HIPAA actually applies

Most Star Steps use is not covered by HIPAA. A parent using a learning app with their own child is not a covered entity, and their data is not protected health information.

HIPAA becomes relevant when a covered entity — a clinic, therapy practice or health plan — uses Star Steps in the course of providing care. In that case we act as a business associate, and a Business Associate Agreement (BAA) is what makes our obligations legally binding. We will execute a BAA on request.

For US public schools, the governing law is usually FERPA rather than HIPAA. We sign Data Processing Agreements for those cases; ask and we will send one.

Safeguards in place today

Everything in this table is implemented in the shipping product and can be verified in review.

Safeguard	HIPAA reference	How Star Steps implements it
Encryption in transit	§164.312(e)	All traffic is TLS. The web app is served over HTTPS with HSTS and a Content Security Policy restricting where data may be sent.
Encryption at rest	§164.312(a)(2)(iv)	All stored data is encrypted at rest by Google Cloud (AES-256) by default.
Access control	§164.312(a)(1)	Per-record authorisation enforced server-side by 36 Firestore security rules. A family's data is readable only by that account and by care-team members it has explicitly invited. Roles (owner / parent / therapist / viewer) are enforced at the database, not just in the UI.
Unique user identification	§164.312(a)(2)(i)	Every actor is an authenticated account; every session and record write is stamped with the contributing user's identity.
Automatic logoff	§164.312(a)(2)(iii)	Inactivity timeout with a warning, then automatic sign-out. Adult areas re-lock the moment the device is handed back to a child.
Authentication for privileged areas	§164.312(d)	Adult surfaces sit behind a parent PIN that is PBKDF2-hashed with a per-account salt and verified server-side, with failed-attempt lockout. It is never checked on the device alone.
Audit controls	§164.312(b)	Append-only, server-only logs for entitlement changes, consent grants and revocations, and care-team membership changes. Access to protected records is logged with actor, record and timestamp.
Integrity	§164.312(c)(1)	Writes go through a retry queue with a durable local snapshot, so a failed write is retried rather than silently lost — and adults are told when it has not landed.
Minimum necessary	§164.502(b)	We collect a child's first name, age, communication mode and learning progress. No addresses, no identifiers beyond the account, no free-text clinical notes are required. Research exports are de-identified with random research codes.
Right of access & deletion	§164.524 / §164.526	Self-service export of a family's data, and deletion of a profile or the whole account, with a scheduled hard-delete that removes it from backups on a defined cycle.
No secondary use	—	No advertising SDKs, no third-party analytics, no advertising identifiers, no sale of data, and no use of your data to train AI models.

What a BAA adds

The controls above are technical. A BAA is what makes them enforceable, and it commits us to breach notification timelines, subcontractor flow-down, and return or destruction of data at the end of an engagement. Our infrastructure runs on Google Cloud services that Google covers under its own BAA, which is the foundation the agreement rests on.

One limitation we will not bury. Star Steps includes an optional AI companion. When it is enabled, what a child types is sent to a third-party AI provider to generate a reply. That provider sits outside our Google Cloud BAA. For any HIPAA-covered deployment, the AI companion is disabled by default and remains off unless a separate agreement covering that provider is in place. Every other feature works normally. We would rather turn a feature off than quietly route protected information somewhere it should not go.

Where we are honest about the gaps

Compliance is a programme, not a checkbox. As of this update:

Independent security audit: not yet performed. We have run internal reviews and fixed what they found, but no third party has assessed us. We will not claim otherwise.
Accessibility conformance report (VPAT/ACR): not yet produced. The product is built to WCAG 2.1 AA and tested against the real palette and controls on every build, but a formal audit with assistive-technology testing has not been done.
Penetration testing: not yet commissioned.
SOC 2: not held. Star Steps is a small operation; we would rather tell you that than imply otherwise.

If any of these is a procurement requirement for you, tell us — it helps us prioritise, and we will be straight with you about timelines.

Reporting a security issue

Email n8wray@gmail.com with "SECURITY" in the subject. Good-faith research is welcome and we will not pursue action against researchers who report responsibly and avoid accessing other users' data. We aim to acknowledge within two business days.