The controls you can turn on
| Control | What it does |
|---|---|
| Automatic Logoff | Signs a user out after a period of inactivity, with a warning first. Enforced both in the app and on the server. |
| Secure file storage | Files on a Secure field live in a private bucket and download through short-lived signed links instead of permanent public URLs. |
| Password policy | Complexity rules (length, mixed case, number, symbol, no common passwords) plus change, expiry, and reset flows. |
| Two-factor authentication | A second factor for account members and for your app's end users. |
| IP allow / block lists | Restrict which networks can reach the app. |
| PHI classification | Mark which tables and fields contain protected health information. |
Hosting and the BAA
HIPAA-eligible apps run on Tadabase AI's AWS infrastructure, which is covered by a Business Associate Agreement. The Compliance Center shows, per interface, which hosting provider it uses and whether that provider is BAA-covered — so you can confirm a PHI-bearing interface is on covered infrastructure.