Aptible Blog

Aptible (YC S14) | Remote (Pacific-Eastern Time Zones) | https://www.aptible.com Aptible helps create a more trustworthy internet by improving data security and compliance. We make it simple for modern businesses to manage compliance so that they can build customer trust. To learn more about who we are, our culture, and whether this is the right place for you, read our Owner's Manual (https://www.aptible.com/owners-manual) and profile on Key Values (https://www.keyvalues.com/aptible). Open Role(s): - Security Engineer: https://jobs.lever.co/aptible/54889be8-def5-4627-965b-b92b235f93d3

> Technically, we could claim that we are HIPAA compliant, as we don't store PHI Disclaimer: I am not a lawyer, I am not your lawyer, and this is not legal advice. There's a lot more to being HIPAA compliant than how you store PHI. As an engineer, you might view not storing PHI as compliance-by-default (the null case), but I don't think a lawyer would agree. Even if you're correct and HIPAA doesn't apply to you (which I'm not convinced is the case), it'd be like saying "we're PCI-compliant, because we don't store any financial information or process any financial transactions". For what it's worth, I founded a company that does store PHI, and we had to get a BAA with AWS (though we ended up using Aptible (YC S14)[0] for hosting and compliance, as it's much easier. Using Aptible is like using Heroku (git push to deploy), and they manage not just the data backups/retention/etc. from a technical standpoint, but all of the human training and paperwork aspects to compliance[1]. [0] https://www.aptible.com/ [1] Which, to be honest, is the tough stuff. From a technological perspective, HIPAA doesn't really mandate much that developers of robust applications shouldn't already be doing, but it's the matter of actually demonstrating that you've done everything in compliance with the law that makes things complicated. Having the 'rubber stamp' of a third-party company that specializes in this matter gives immense peace-of-mind as the CTO, compared to the DIY approach.

People keep making the same argument against Aptible (https://aptible.com) and it is still a very successful PaaS over a decade later.

You might check out https://www.aptible.com/. It's not quite as ridiculously simple as Heroku but they are HIPAA compliant.

I wrote this guide that you might find useful: https://harries.co/mvp-hipaa-compliance/ This is great too: https://www.aptible.com/hipaa and https://github.com/truevault/hipaa-compliance-developers-guide

Yeah... HIPAA is definitely tough. I'd check out https://www.aptible.com if you haven't already. It will at least help out with the infrastructure side of things. Although it does seem like Heroku is offering some services that help too (https://blog.heroku.com/announcing-heroku-shield). It's definitely not enough alone, but at least gets you going on the security & compliance aspects.

Aptible (YC S14) | Senior Software Engineers, Site Reliability Engineers, and Support Engineers | Remote At Aptible, we make people-centered security products that help developer teams build security into their architecture and their organization’s culture: Enclave is a container orchestration platform built for developers that automates security best practices and controls needed for deploying and scaling Dockerized apps in regulated industries. Gridiron is like the missing QuickBooks for security management. It helps developers design and run security management programs that meet and exceed requirements like HIPAA, SOC 2, and ISO 27001. Customers use it to build trust with their own customers and partners, and prepare for certifications. Learn more at https://www.aptible.com/company/

Yes, that is very true. I am planning to move my hosting to Aptible [1], and will become PCI certified and HIPAA compliant. If anyone is interested in FormAPI, but requires PCI certification and HIPAA compliance, please send an email to [email protected]. We'll let you know when we are ready. You can also send an email to [email protected] to inquire about on-site hosting. [1] https://www.aptible.com/

I'd never do it either, not because of privacy concerns but ethical reasons against Facebook benefitting from whatever they gather about such transactions. To the other commenters, I'm sure the poster is aware of HIPAA. Luma Health works with Aptible, an "HIPAA Security and Compliance Platform". (Source: https://www.lumahealth.io/about-us/ near the bottom, and https://www.aptible.com/)

Another option is to use Aptible: https://www.aptible.com/ It's basically (a better) Heroku with an emphasis on enabling HIPAA/HITECH compliance. They do both app and DB hosting (including Postgres). And it's on AWS so integrates easily with existing infrastructure/code. Disclaimer: Biased as I know the founders and we use the product. But they are good people and it's a good product!

If you want a HIPAA-compliant server setup for you: https://www.aptible.com/ (S14)

For those interested in more advice on actual application/interview, our friends at Aptible wrote a great post on that here: https://www.aptible.com/blog/y_combinator.html

Aptible is another young startup in the HIPAA space: https://www.aptible.com/ They support a PaaS model similar to Heroku.

How do you beat https://www.aptible.com/?

Aptible | Remote | Multiple technical and non-technical roles for those interested in Internet security https://www.aptible.com/company/ Aptible makes people-centered security products that help SaaS developer teams build security into their architecture and their organization's culture. * Enclave is a container orchestration platform built for developers that automates security best practices and controls needed for deploying and scaling Dockerized apps in regulated industries. * Gridiron is like the missing QuickBooks for security management. It helps developers design and run security management programs that meet and exceed requirements like HIPAA, SOC 2, and ISO 27001. Customers use it to build trust with their own customers and partners, and prepare for certifications. Important skills we are looking for include: EmberJS, DevOps/Site Reliability, Security & Compliance (HIPAA, HITRUST, ISO 27001, SOC 2, PCI-DSS, GDPR, etc.) expertise, SaaS Operations/Generalists, and more. We would love to talk with anyone who is interested in Internet security and has one or more of the competencies listed above. Specific roles that we are looking for today: 1. Senior Site Reliability Engineer 2. Senior Software Engineer 3. Support Engineer 4. Growth Ops (Sales Ops / Marketing Ops) Reasons to work at Aptible: * Small team, (relatively) large customer base filled with innovators in challenging industries (namely healthtech and fintech) * Fully remote * Our products have…

Aptible has always prioritized security, and is a competitive alternative. https://www.aptible.com/heroku-alternative/

Thanks for sharing your application with us. It's great to analyze a well thought out and well worded application. I've posted some links below that have helped me understand their process in a little more depth, especially the interview. These links have been posted at some point on HN, but I'm just putting them here for anyone's convenience. I hope you find them useful: http://old.ycombinator.com/howtoprepare.html http://ycinterview.com/ http://ipaulgraham.herokuapp.com/ https://www.aptible.com/blog/y_combinator.html http://yourstory.com/2014/10/guide-list-y-combinator/ The last one is especially helpful, it should answer just about any question and has other examples of great applications.

It'd be very useful to have at the end of the questions a list of all of them showing the response time and sorted by it. That way you get an idea of which ones took too long or too short and improve them. Here more questions (it's not mine, I just found it a while ago): https://www.aptible.com/blog/y_combinator.html Good luck to everyone for the interview! We're still waiting a reply for our late application

Really useful tool. I would also take a look at this article, which has a prioritization of the different questions out there, and therefore which to focus on: https://www.aptible.com/blog/y_combinator.html

Checkout aptible [https://www.aptible.com/]- they do hippa compliance as a service.