WCAG 2.1 AA target
Accessibility
Public routes are covered by automated axe scans. Authenticated route scans and manual screen-reader review remain part of release validation.
Launch readiness
Built for trust, not false stamps.
SpectrumPathways is built with accessibility, privacy, security, and AI guardrails as launch requirements. This page describes the technical posture honestly: it is not a legal certification, BAA, HIPAA attestation, or third-party audit report.
Last reviewed 2026-09-06 · questions: hello@spectrumpathways.ai
The four questions we get asked first
- Where does our data live?
- United States. Application data and uploaded documents live in a Supabase project provisioned in US West (us-west-1), verified 2026-09-06. The application runs on Vercel. We select US regions for every vendor that stores family data; if that ever changes for a vendor, this page changes first.
- Is it encrypted?
- In transit over TLS, and at rest by the storage layer. Row-level security is enforced in the database so one family’s records are not reachable from another family’s session: all 87 tables in the application schema have RLS enabled, and every one carries at least one policy — audited 2026-09-06, no gaps. Actions that read or change a family’s records — creating a case, opening a document, running an export — are written to an append-only audit log with the acting user, the record touched and the time.
- Can we get a BAA?
- Not as a standing signed offer today. We execute BAAs as part of pilot onboarding, and the prerequisites we complete first are listed below — vendor BAAs, MFA enforcement, and written retention and breach-response procedures. Email us with your procurement timeline and we will tell you which of those are already done, rather than route you to a sales call.
- Does the AI make decisions?
- No. Compass drafts plain-English explanations with source reminders and tells families to verify legal, medical, school, agency and provider decisions. It does not determine eligibility, submit applications, or advise on appeals.
Who else touches the data
Vendors that process or store family data, as of the review date above. We update this page before adding a vendor that processes family data.
| Vendor | What it does | Region |
|---|---|---|
| Supabase | Application database, authentication, and document storage | United States |
| Vercel | Application hosting, edge network, and build infrastructure | United States |
| Resend | Transactional email (account, deadline and nurture messages) | United States |
| Stripe | Payment processing. Card data never reaches our systems. | United States |
| Sentry | Error monitoring, with request scrubbing applied before transmission | United States |
| Retell AI | Powers our voice line for families who would rather call than type | United States |
| AI model provider | Generates Compass draft explanations. Family context is sent to the model at request time; it is not used to train third-party models. | United States |
| Vercel Analytics / Speed Insights | Aggregate page performance on public marketing pages. | United States |
Security-oriented controls
HIPAA / CMIA posture
The app is built around private authenticated records, Supabase RLS, audit logging patterns, and no advertising trackers in authenticated workflows.
Cited drafts, not decisions
AI guardrails
Family+AI and Bulletin AI provide plain-English drafts with source reminders and tell families to verify legal, medical, school, agency, and provider decisions.
Launch candidate
Overall readiness
The product is ready for focused pilot validation once production vendor, BAA, accessibility, and resource data checks are completed.
Required before a regulated PHI production deployment
- Execute BAAs for vendors that may handle PHI, including Supabase, Vercel, and Sentry if enabled for PHI environments.
- Enforce MFA for production admin, hosting, database, source control, and monitoring accounts.
- Complete authenticated axe scans, keyboard-only QA, and screen-reader smoke tests before public launch claims.
- Define retention, deletion, export, breach response, and support access procedures in written operating policies.
- Populate and verify priority local resources by state and county before marketing full local coverage.
Accessibility statement
WCAG target, support path, and known validation approach.
Privacy summary
Sensitive information handling and user choices.
Professional pilot
Workflow and compliance scoping before storing live client records.
