What Fonteum is · What Fonteum is not
Federal data, passed through without enrichment.
What Fonteum does not do
No enrichment. No scoring. No inference.
Data not ingested
Explicit rejection list.
Security posture
No certifications we don't hold.
Fonteum is not SOC 2 attested and does not currently hold a SOC 2 (Type 1 or Type 2), HIPAA, or ISO 27001 attestation, and displays no badge it does not hold. The hosting and data tiers run on SOC 2 Type 2 attested infrastructure (Vercel, Supabase). For procurement requiring a specific attestation, contact security@fonteum.com.
Infrastructure: Vercel (application hosting) + Supabase (managed Postgres, row-level security enforced). Encryption in transit (TLS 1.2+) and at rest. No service-role keys shipped to the browser.
HITRUST i1 evaluation planned for 2027 — i1 (Implemented, 1-year) is the appropriate scope for a no-PHI public-data platform. HIPAA covered-entity status is not applicable — Fonteum processes no PHI.
Vulnerability disclosure: security@fonteum.com · /.well-known/security.txt (RFC 9116).
BAA availability
BAA template on request.
Because Fonteum processes no PHI, BAA execution is typically not required under HIPAA for data ingestion. The template exists as a procurement formality for partners whose internal compliance review requires a signed BAA regardless of processing scope.
Download audit pack (includes BAA template) →Customer evidence
Pilot intake open.
Fonteum does not currently hold SOC 2. Customer evidence published as pilots close. No fake logos, no anonymous testimonials.
Incident disclosure policy
72-hour incident disclosure. Public corrections log.
If a confirmed unauthorized access to user data is discovered, Fonteum notifies affected parties within 72 hours of confirmation and posts a public statement naming the scope of access, the affected data classes, the time window, and the remediation steps taken.
Data-quality incidents (a wrong figure on a live page) follow the same corrections workflow and are logged below alongside doctrinal corrections. Fonteum has not had a breach to date. The policy exists so the threshold is documented.
Corrections log · last 30 days
Federal-source corrections and re-sync timestamps.
Last 30 days · 5 entries · static snapshot — live feed in Q3 2026
2026-05-25
Accepted
CMS Care Compare · Dataset sync
Home health agency count reconciled with upstream CMS quarterly release. 12,392 CCN-keyed records confirmed.
2026-05-24
Accepted
CMS Provider of Services · Schema update
POS facility type field mapping updated to align with CMS April 2026 release schema.
2026-05-20
Accepted
HHS-OIG · Record count update
Monthly LEIE refresh completed. 68,055 exclusion records confirmed current.
2026-05-15
Accepted
CMS Care Compare · Hospice data refresh
Q1 2026 Care Compare Hospice refresh completed. 6,943 facility records updated.
2026-05-10
Accepted
CMS QPP · Score recalculation
PY2023 individual clinician scores updated following CMS correction bulletin.