Stactica

Pass the security review that's blocking your first health-system deal.

Fixed-scope HIPAA and SOC 2 engineering for seed–Series A startups putting LLMs on patient data. You get a PHI-safe architecture, the right BAA and zero-retention setup with your cloud and LLM vendors, controls as code, and an evidence pack your sales team can reuse.

Book a free 30-min triageSee the LLM BAA matrix

The problems we fix

BAA gaps

Your LLM vendor's BAA doesn't cover the endpoint, model or feature you actually use.

Retention left on

Zero data retention was never enabled, or logs and traces quietly keep PHI.

PHI in the wrong places

Patient data ends up in prompts, analytics, error trackers or vendor dashboards.

The questionnaire wall

A 300-question security review and no defensible, documented answers.

The PHI-Safe AI Architecture Sprint

About 30 days, fixed scope.

  1. PHI data-flow and vendor map: where patient data enters, moves and is stored, and which subprocessors touch it.
  2. BAA and zero-retention setup across AWS, GCP or Azure and your LLM providers (Anthropic, OpenAI, Bedrock, Vertex, Azure OpenAI).
  3. Controls as code (Terraform): encryption, audit logging, least-privilege access, environment separation.
  4. Application guardrails: PHI-safe logging, redaction before prompts where needed, tenant isolation for AI features.
  5. Evidence pack: a one-page architecture summary and a security-questionnaire answer bank.
  6. Optional: Vanta or Drata setup and HIPAA policy drafts for your counsel to review.

From $9,500 fixed. Optional monthly retainer for security reviews and new AI features.

How it works

  1. Free 30-min triage: bring your architecture or the questionnaire that's blocking you. You leave with a gap list either way.
  2. Fixed-scope proposal within two business days.
  3. Weeks 1–4: design, then pull requests into your repos, then the evidence pack, with a weekly check-in.

Who you'd work with

Shain Lafazan, principal AI engineer. As Head of Product Engineering at Advocate, an AI platform for disability claims, he took the company to SOC 2 and HIPAA from scratch on Vanta with 100% infrastructure-as-code on AWS, integrated EHR data over FHIR and HL7, and built HIPAA-gated LLM pipelines. Earlier: Principal / Staff Engineer at Sureify (life-insurance software for Fortune 500 carriers) and Tech Lead at HeartFlow.

Book a free 30-min triage