Are you a HIPAA covered entity? Do you sign a BAA?
Softwerk is a business associate when a build touches protected health information, and we sign a Business Associate Agreement before that happens. A discovery sprint runs on sandbox or de-identified data and needs no BAA. Once a BAA is in place, we run the engagement with the HIPAA profile enforced in the gate, and the certificate records the per-framework verdict. The certificate, not a badge, is what an auditor can check.
We're not a hospital or a health plan. Does any of this apply to us?
Probably yes. The FTC's Health Breach Notification Rule covers personal health record vendors and related apps outside HIPAA. The FTC used it against GoodRx (2023-02, $1.5 million) and Premom (2023-05, $100,000) under the original rule, and the amendment in effect since 2024-07-29 codified the reach: health apps, a 60-day notice duty, FTC notice at 500 or more affected people, and disclosure of any third party, ad platforms included, that received the data. BetterHelp (2023) and Cerebral (2024) were pursued under Section 5 of the FTC Act for the same pattern. Not being a HIPAA covered entity is not a safe harbor.
What about tracking pixels and sharing data with Meta or Google for ads?
This is where FTC enforcement in DTC health has concentrated: GoodRx, BetterHelp, and Premom in 2023, Cerebral in 2024, the 2026 suit against Hims & Hers, and an aggregator tally of more than $100 million in pixel-tracking penalties and settlements against US hospitals, telehealth platforms, and health apps since 2023. What we commit to as a service: analytics are consent-gated, no third-party ad or analytics tag is placed on a surface that carries health data, and that rule is written into the build spec and checked at review before merge. Separately, a dedicated PHI-guard service scans every generated write for identifiers and, in enforcing mode, blocks a write that carries one. Those are two different checks. We do not claim the PHI guard detects ad tags.
Do you handle PCI-DSS for checkout and subscription billing?
Not as a live module in the gate, and we say so rather than claim a checklist that does not exist. What we do in a build: route cardholder data through a PCI DSS-certified, tokenized payment processor so card numbers never reach your servers or ours. That is how a PCI-DSS scope is kept small. It is a design commitment we make as a service, not a gate module, and your own attestation process stays yours. PCI DSS 4.0's future-dated requirements have been mandatory since 2025-03-31.
What about FDA rules on DTC drug advertising?
The gate does not run an FDA promotional-review profile, and we do not claim it does. On 2025-09-09 FDA and HHS sent roughly 100 cease-and-desist letters over DTC drug advertising and warning letters to about 30 telehealth companies, and FDA has proposed removing the “adequate provision” option for broadcast ads. What we build is the infrastructure that makes your MLR or legal review fast to do and easy to prove: versioned content, an audit trail of what shipped when, and a review step your team sits inside. The promotional judgment stays with you.
Do you validate to GxP or 21 CFR Part 11?
Not as a coded profile in the gate. It is flagged not live wherever it appears. What the engagement gives you instead: a write-once, content-addressed certificate, a sha256 of the exact source tree, for every build. FDA's Computer Software Assurance guidance (2025-09-24) favors risk-proportionate evidence, and the certificate is usable evidence in that framing. It is not a substitute for a GxP checklist, and we do not sell it as one.
Who owns the code, and who is responsible if AI-generated code is wrong?
You own the delivered work product under the engagement terms. A certificate carries the sha256 of the exact source tree, the commit it was minted for, and the compliance verdict. The certificate does not record which model reviewed the build. Independence is enforced where the review runs: a review from the same model family that generated the work is refused. It is a build attestation of the kind buyers now ask for alongside a Software Bill of Materials; the factory does not produce an SBOM. On responsibility: model vendors disclaim broadly in their terms of service, Softwerk is responsible for delivering to the agreed acceptance criteria, and operating what we build is yours, as in any services engagement.
How independent is the review, and where does a human fit in?
The reviewer is pinned to a model family distinct from the one that generated the work, and a review from the same family is refused rather than allowed through. The same agent never signs off on its own work. That is the change-approval separation SOC 2 auditors test under CC8.1, applied to models. We do not claim “human-in-the-loop” as a safety guarantee on its own. A human reviewer is only as good as what they can see and how much time they have, so an Operate scope names exactly what a human reviews, when, and what they are shown.
Can we use the factory ourselves, without an engagement?
Not today. Sign-in at app.softwerk.io is limited to workspaces Softwerk sets up during an engagement. The Sign in link (in the header on larger screens, in the footer on phones) is for those workspaces.
Is the gate switched on for our project, or is it a setting?
It is a setting, and the engagement scope names it. The verification gate, the compliance veto, and the PHI guard each carry their own enforcement flag in the factory, and each is off until an operator turns it on. Off, the checks still run and their findings are still recorded, but nothing is withheld. On, they refuse the merge or the write, and the safe state is stop. We turn all three on for the workspace that builds your software, we put that in writing in the scope, and you can ask to see the setting on your workspace at any point in the engagement.