Skip to content
Ferryway

Security & compliance

A higher bar, treated as the starting line.

Behavioral-health infrastructure only works if providers, agencies, and the public can trust it. Here is exactly where our security and compliance posture stands today — stated plainly, with nothing overstated.

Principles

Four commitments the platform is shaped around.

Data minimization by architecture

The core network runs on facility-level inventory — open beds, levels of care, intake requirements. It is designed so that solving placement never requires centralizing protected health information. The least risky data is the data you never collect.

HIPAA & 42 CFR Part 2 as design constraints

Behavioral-health and substance-use records carry heightened protections. We treat HIPAA and 42 CFR Part 2 as constraints the platform is shaped around from day one — not certifications to chase after launch.

Security as a default

Encryption in transit and at rest, role-based access, least-privilege permissions, and audit logging are foundational platform requirements. This marketing site itself ships a strict Content-Security-Policy, HSTS, and locked-down permissions headers.

Accountable to public-sector standards

Counties, states, hospitals, and health systems have procurement, privacy, and data-governance bars for a reason. We're building to clear them — and we welcome detailed security review from prospective partners.

This website, today

What this site does — and deliberately doesn't do.

Compliance claims should be verifiable. These are facts about the site you're reading right now.

  • Only strictly-necessary cookies are used — a sign-in session cookie, and Stripe's fraud-prevention cookies where a payment form is shown. No tracking cookies.
  • The contact form is currently UI-only: submissions are not transmitted or stored anywhere.
  • No analytics or advertising scripts, pixels, or ad tech run on this site. Payment processing is handled by Stripe (PCI-DSS Level 1) — card data never reaches Ferryway servers.
  • Strict security headers: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Content-Type-Options, frame-ancestors 'none', and a restrictive Permissions-Policy.
  • No PHI, no patient data, and no medical records exist anywhere in this site or its code.

Posture over time

Honest about stage. Deliberate about sequence.

Ferryway is pre-seed. We won't claim certifications we don't hold — here's what's true now and what will be true before any deployment touches real data.

Now
  • No-PHI marketing site with strict security headers
  • Data-minimization architecture for the core network
  • Security & privacy review welcomed from prospective partners
Before any pilot handles real data
  • Independent security assessment
  • Business Associate Agreements (BAAs) where required
  • Formal incident-response and breach-notification procedures
  • Role-based access controls and audit logging in production

Ferryway is a coordination and availability platform, not a medical record system or a provider of care. Nothing on this page is a certification claim. Prospective agency and health-system partners: we welcome your security questionnaires and detailed review.

Found a security issue, or have a compliance question?

Responsible disclosure is welcome and appreciated. Email us directly and we'll respond promptly.

markovanzyl@ferryway.netRequest a compliance walkthrough