Health-tech, clinical research, legal discovery, M&A diligence — any project that touches regulated data or client secrets needs a coordinator you can trust with the fine-grained details. Maven was engineered for that.
HIPAA doesn't let you treat Protected Health Information casually. Every project brief, status update, and contributor reply that touches patient data lives in your email thread — which means the Email PM you trust with project coordination also becomes the Email PM you trust with PHI. This page walks through exactly what Maven ships to make that handoff safe.
✓ AES-256-GCM at rest · ✓ HIPAA §164.530(j) 6-year retention · ✓ Append-only audit log · ✓ Owner-controlled deletion
phi_accessed flag. Rows are append-only — once a read lands, it cannot be edited, only reviewed by your compliance officer.admin_audit_log with resource_type, resource_id, and phi_accessed indexed for compliance-officer review.
key_version baked into each envelope for forward rotation.
hipaa_6y retention policy configurable per project, with a scheduled purge sweep that records every deletion in the audit trail.
project_consent_receipts ledger captures consent text, version, source, IP hash, and acknowledgment timestamp per recipient.
admin_audit_log is retained independently of project retention, so close-and-purge cannot erase who saw what.
What follows isn't marketing — it's the implementation summary we'd hand to your security reviewer. If a question on this page would survive a SOC 2 walkthrough with our team, we ship it as a documented control. If it wouldn't, we mark it as roadmap.
Encryption. AES-256-GCM, six-byte IVs are not the spec — 12-byte IVs are, and Maven's lib/phiCrypto.js follows the NIST recommendation. Each row gets a fresh IV at write time, and the auth tag is concatenated into the ciphertext so read paths detect tampering. The key lives in PHI_ENCRYPTION_KEY as 32 bytes of hex or base64; rotating it requires a key_version bump on the envelope, then a backfill pass.
Retention. Each projects row carries a retention_policy of standard_7y, hipaa_6y, closed_30d, or legal_hold. A scheduled sweep, defined in lib/dataRetention.js and run from the data-retention-purge-sweep cron in polsia.toml, writes an admin_audit_log row tagged data.purge with resource_type='project' and phi_accessed=TRUE before the project's row cascades. The audit row is the only thing that survives the cascade — that is the point.
Audit. The migration 1802000000000_add_data_access_audit_target.js extended admin_audit_log with the resource-type, resource-id, and phi_accessed columns compliance officers look for. Rows are append-only — there is no UPDATE admin_audit_log production path. A partial index on phi_accessed = TRUE keeps the show me what was accessed query cheap regardless of total log size.
Consent. project_consent_receipts is a separate ledger from projects on purpose. Editing the project row doesn't erase the receipt; the receipt row can only be superseded by a newer receipt for the same recipient. The ledger captures the consent text the recipient actually saw, the version tag, the source step (signup / brief / reply / settings / api), the IP hash, the user-agent string, and the acknowledged-at timestamp.
Deletion. Closing an account runs a transactional delete with cascade against every dependent table — deliverables, threads, collaborators, side_conversations, requests, decisions. The closed_30d policy delays cascading for 30 days so an accidental close can be reversed; legal_hold blocks purge entirely until an admin revokes it.
Maven is a beta product. The four controls above are the HIPAA baseline. The list below is real, scoped work that has not shipped — your security reviewer can ask, and we can answer "not yet" with a date rather than a hand-wave.
If you're evaluating Maven for a HIPAA-regulated project, email us. We'll send the engineering brief above as PDF, walk you through the audit log shape, and explain the data flow for your specific scenario.