Overview › Infrastructure

Infrastructure Security

CareSphere runs on AWS with full BAA coverage, combined with a secure IoT edge layer that brings AI-assisted care monitoring to individual resident rooms.

☁️

AWS Cloud Architecture

All HIPAA-eligible services covered under AWS Business Associate Agreement

🗄️

Amazon Aurora PostgreSQL

Primary data store. Encryption at rest with KMS CMK. rds.force_ssl = 1 enforces TLS on all connections. Automated backups retained 35 days; S3 Glacier archival after 2 years. Multi-AZ failover for high availability.

🔐

AWS KMS

Customer Managed Keys used for Aurora storage, S3 backup, and Secrets Manager encryption. Key rotation is annual and automatic. KMS key policies restrict usage to the CareSphere IAM role only.

🔑

AWS Secrets Manager

PHI encryption key, database password, and JWT secrets stored and rotated via Secrets Manager. The API resolves secrets at startup — no secrets in environment files, Docker images, or source code in production.

👤

Amazon Cognito

Identity provider for SSO flows (Google, Microsoft Entra). Manages user pool, MFA, and PKCE-based OAuth 2.0. Post-authentication and post-confirmation Lambda triggers handle user lifecycle in CareSphere.

🪣

Amazon S3

Encrypted document and photo storage (resident photos, cert documents). S3 paths themselves are encrypted in the database as PHI. Bucket policies restrict access to the application IAM role. Versioning enabled for accidental-deletion recovery.

📊

CloudWatch Logs

Centralised log aggregation for application events, audit logs, and infrastructure metrics. Log groups encrypted with KMS. CloudWatch Logs Insights queries feed SIEM alerting for anomalous access patterns.

✅
AWS BAA Signed — CareSphere has an executed Business Associate Agreement with AWS covering all services above. PHI never leaves BAA-covered infrastructure. Sub-processors are reviewed annually.
🤖

IoT & AI Edge Security

ESP32 sensors and on-premise AI brain nodes — secured from firmware to cloud

The CareSphere IoT layer consists of ESP32-based sensors in resident rooms communicating with an on-premise AI brain node (local inference server). The AI brain aggregates sensor data, runs real-time wellness models, and syncs results to the AWS backend — minimising PHI exposure on the network edge.

Device Authentication

  • Each ESP32 device provisioned with a unique X.509 certificate via AWS IoT Core
  • Mutual TLS (mTLS) — both device and server authenticate each other
  • Certificates are device-unique and revocable independently without affecting other devices
  • Device identity bound to the facility record in CareSphere

Data in Transit (IoT)

  • MQTT over TLS 1.2+ for all sensor→AI brain→cloud communication
  • HTTPS for AI brain REST calls to the CareSphere API
  • No unencrypted sensor data leaves the device
  • Message payloads contain sensor readings only — no PHI (name, DOB, MRN)

Local AI Brain Security

  • On-premise inference server runs in an isolated VLAN within the facility
  • Only the CareSphere API's service account can call AI brain endpoints
  • AI model weights and inference outputs are not transmitted off-premise in real time
  • Sync to cloud uses batch aggregation — raw video or audio never leaves the facility

Firmware Security

  • Signed firmware images — unsigned firmware rejected by secure boot
  • Over-the-air (OTA) updates cryptographically verified before installation
  • Flash memory encrypted with device-unique key
  • Debug interfaces (JTAG/UART) disabled in production builds
🧠
Privacy-by-design on the edge — The AI brain processes sensor data locally and sends only derived insights (e.g. "resident activity score: low") to the cloud API. Raw sensor streams — including audio or motion data — remain on-premise and are subject to the same facility-level access controls as other PHI.
🌐

Network Security

Defence-in-depth from the internet edge to the database subnet

VPC Isolation
CareSphere runs in a dedicated AWS VPC. Database and AI services are in private subnets with no internet-facing ingress. Only the API load balancer is in a public subnet.
ACTIVE
Security Groups
Least-privilege inbound rules: Aurora accepts connections from the API security group only; IoT Core accepts MQTT from device certificate pools only.
ACTIVE
HTTPS / HSTS
All web traffic is HTTPS with Let's Encrypt (or ACM) certificates. HSTS headers enforced with 1-year max-age.
ENFORCED
DDoS Protection
AWS Shield Standard active on all public endpoints. Rate limiting enforced at the API gateway and application middleware layers.
ACTIVE
Vulnerability Scanning
Amazon Inspector continuously scans EC2, Lambda, and container images for known CVEs. Critical findings trigger automated Slack/PagerDuty alerts.
CONTINUOUS
Penetration Testing
Annual third-party penetration test covering API, web UI, IoT endpoints, and internal network. Reports available under NDA to enterprise customers.
ANNUAL