Information Security Policy

Mahlum Innovations LLC · Effective July 2026

This is the top-level security policy for Chronos, an AI medical-chronology service processing protected health information (PHI) for law-firm customers. It covers every system that creates, receives, maintains, or transmits customer data: our HIPAA-eligible production hosting (Aptible), BAA-covered US cloud file storage, our source code repositories, development environments (which never contain PHI), and vendor consoles.

Chronos is founder-operated (Mahlum Innovations LLC). This policy describes the controls that actually exist rather than an org chart that does not, and where frameworks expect personnel-level separation of duties we rely on strong, verifiable technical controls instead — and say so plainly.

1. Security objectives

1. Confidentiality of PHI and client confidences. Medical records are the most sensitive data we hold; attorney work product embedded in case data is a close second.
2. Integrity of chronologies and audit trails. Outputs are used in litigation, so per-line source citations and the tamper-evident audit log must be trustworthy.
3. Availability consistent with our published SLA (99.9% monthly).
4. Truthful representation. We publish only security and compliance claims that are literally true, and we do not claim certifications we do not hold.

2. Governance

The founder is the accountable security official. All policy approvals, exceptions, and risk acceptances are recorded in writing. Every policy is reviewed at least annually and after any material architecture change, security incident, or new legal obligation. A written risk assessment is performed at least annually.

The HIPAA Security Rule NPRM (Jan 2025) direction — mandatory MFA, universal encryption, vulnerability scanning, annual penetration testing, asset inventory, 72-hour restoration — is treated as our design target ahead of it becoming final.

3. Data classification

PHI / Case data

Lives only on BAA-covered production infrastructure, encrypted AES-256 at rest and TLS 1.3 in transit, never in development environments, logs, or analytics, never retained by our AI provider, and never used to train models.

Customer business data

Accounts and billing information is shared with subprocessors on a minimum-necessary basis per our published subprocessor list.

Public content

Must be accurate and passes a truthful-claims review before publication. Published security and compliance claims are re-verified weekly; regressions are treated as emergencies.

4. Core control commitments

Each of the following controls is verifiable today:

• AES-256 at rest and TLS 1.3 in transit with verified certificate-pinned database TLS.
• Unique accounts with globally enforced, fail-closed MFA, least-privilege permissions, and tenant isolation — every platform-admin action is written to the customer's own audit log.
• Append-only, tamper-evident, per-firm audit log exportable by firm admins at any time.
• AI processing only through a BAA-covered gateway with zero data retention and a fail-closed production configuration. PHI is processed in-context only and never persisted by the AI provider.
• Customer-controlled hard deletion that removes files from object storage and all database records atomically and irreversibly. Backup age-out is bounded at 12 months.
• BAA-or-no-PHI rule for every vendor, with a published subprocessor list and 30-day advance notice of material changes.
• Version-controlled change management with automated typecheck and test gates; a deploy that fails preflight does not reach production.
• 24×7 incident-response escalation path with a 72-hour customer breach-notification commitment and independent breach counsel.
• Daily backups (30-day retention) and monthly backups (12-month retention) with a documented restore runbook and point-in-time-recovery capability.
• $2,000,000 Technology Errors & Omissions and Cyber Liability insurance including an Artificial Intelligence coverage endorsement. Certificate of insurance available on request.

5. Personnel security

• Background checks or identity verification before any production or PHI-adjacent access.
• Encrypted, screen-locked, and patched workstations required for all personnel with system access.
• Contractors receive the policy pack at onboarding and work in development environments only — no PHI and no production credentials.

6. Policy review cadence

This policy is reviewed at least annually and after any material architecture change, security incident, or new legal obligation. The current version is v1.0, effective July 2026. Revision history is maintained in version control.