Single source of truth for the Stratum platform — the precedent-based denial intelligence infrastructure that backs the registry API, the customer dashboard, and the regulated-data substrate behind it. Phase 1 scope is precedent object storage and versioning; this page documents the live deployment surface, the read-only registry endpoints exposed to the web, the AWS posture that holds PHI extracts and audit logs, and the compliance controls that underpin both.
The customer-facing platform runs on Cloudflare Workers (frontend) and Fly.io (API + DB). It serves de-identified data only — no PHI flows through this stack.
sc-platform-pages. Custom domain
platform.stratumcollective.co. Not a Pages project — do not reconnect.
stratum-platform-api.fly.dev, sjc region.
Serves registry endpoints and Phase 1 precedent storage. Authentication: Auth0 JWT
bearer (Phase 2A — live); X-User-Id header is dev/test-only fallback.
sc-platform-db. Multi-tenancy via
tenant_id filter on every query. Soft-delete only — 7-year HIPAA retention.
stratum-platform/infra/cloudformation.yml.
Read-only registries loaded at startup by stratum-platform/src/registries/index.ts
and exposed publicly (no authentication). Source of truth for endpoints lives in
stratum-platform/docs/03-API-REFERENCE/ENDPOINTS-REGISTRIES.md;
the table below mirrors that spec.
| Domain | Endpoint | Purpose |
|---|---|---|
| Payer Intelligence | GET /registries/payers | Payer roster with family roll-up, state coverage, plan tiers. |
| Payer Intelligence | GET /registries/payers/:family/profile | Per-family payer profile — denial signals, appeal posture. |
| Payer Intelligence | GET /registries/ma-payers | Medicare Advantage payer registry. |
| Denial & Appeal Patterns | GET /registries/denial-reasons | Denial reason codes, clustering, clinical severity, overturn rates. |
| Denial & Appeal Patterns | GET /registries/appeals | Appeal outcomes corpus — precedent records and rationale. |
| Denial & Appeal Patterns | GET /registries/inappropriate-denial-patterns | Patterns flagged as systemically inappropriate (parity, NQTL). |
| State & Regulatory | GET /registries/states | State-level BH regulatory index. |
| State & Regulatory | GET /registries/states/:state | Per-state detail — parity laws, PA requirements, mandated LOC. |
| State & Regulatory | GET /registries/parity-tracker | Mental health parity enforcement actions and findings. |
| State & Regulatory | GET /registries/nqtl-violations | NQTL violations registry — non-quantitative treatment limits. |
| Clinical & Medical Necessity | GET /registries/criteria | Medical necessity criteria — ASAM, LOCUS, MCG, InterQual references. |
| Clinical & Medical Necessity | GET /registries/cms-coverage | CMS coverage determinations — NCDs, LCDs. |
| Clinical & Medical Necessity | GET /registries/x12-denial-codes | X12 835/277 denial code reference. |
| Research & Precedents | GET /registries/research | Peer-reviewed evidence registry for appeal support. |
| Research & Precedents | GET /registries/precedents | Precedent records — cross-payer, cross-state appeal outcomes. |
Decision recorded 2026-04-16. AWS account 947073314047, region
us-west-2, BAA active since 2025-12-23
(customer-agreement-S951Sgj1601wcNeR). The platform app does not run on AWS —
Fly.io serves all real traffic. AWS is the regulated-data substrate and a cold-but-ready
compute target for any enterprise customer whose procurement requires AWS hosting. Re-activation
from the CloudFormation template takes ~2 hours.
phi-uploads-dev-stratumcollective, phi-sanitized-dev-stratumcollective — KMS-encrypted, versioned, public-access blocked, TLS-only + SSE-required policies.stratum-cloudtrail-947073314047 — AES-256, TLS-only, 7-year retention (Glacier at 90d).stratum-multiregion-trail — multi-region, log-file validation enabled, S3 data events on PHI/audit buckets.8ececbd592d7615d75c985ec6e7dd586 — S3 log monitoring, 15-min finding frequency.alias/aws/rds, alias/aws/s3 (AWS-managed). CMK migration available if compliance escalates.Stratum-Admin with U2F MFA. No service accounts.stratum-api repository — Docker images preserved for re-activation.stratum-platform/infra/cloudformation.yml — single-source re-activation template.stratum-api-production — deleted 2026-04-16 via CloudFormation stack delete. ~$60–80/mo saved.stratum-production — deleted with snapshot retained as stratum-production-final-20260416-1219.compliance/aws-app-runner-reactivation.md — when to re-activate, CloudFormation re-deploy, custom domain attachment, data-sync options, cost expectations.The current platform handles only de-identified data on Fly.io. PHI is confined to AWS S3 buckets covered by the BAA, encrypted with KMS, and audited via CloudTrail. PHI export from the API uses HIPAA Safe Harbor de-identification (45 CFR 164.514(b)(2)) — all 18 identifiers stripped on export; inbound 422-rejection guard currently covers 10/18 (full coverage tracked as Phase 2B work).
deidentify.ts — what gets stripped on
export, which identifiers the inbound guard catches today, and the work to extend
inbound coverage to all 18.
stratum-platform/docs/ — data models, core systems, API reference,
registries, frontend, implementation guides, governance & ADRs.
stratum-platform/CLAUDE.md. Edit there — this page indexes; the repo is canonical
for code-adjacent context.
compliance/aws-data-flow.md — where PHI lives, who can read it, how it gets
encrypted and logged.
compliance/aws-app-runner-reactivation.md — step-by-step CloudFormation
re-deploy, custom domain attachment, data sync, cost expectations.