US hosting, security and getting ready for SOC 2
Production runs in US regions of cloud accounts your company owns: typically AWS US East (N. Virginia, us-east-1) or US West (Oregon, us-west-2), with the Next.js front end on Vercel or AWS. The repository lives in your GitHub organisation from the first commit.
Many B2B SaaS companies are asked for a SOC 2 report once they sell to larger customers. We do not hold a SOC 2 attestation and do not claim one. What we do is build the product with the controls your own audit will look at, so you are not retrofitting them later:
- least-privilege access, with production credentials held by a named person and logged;
- every change through a reviewed pull request and an automated pipeline, so the history is your change log;
- audit logs for sign-ins, permission changes and data exports in the application itself;
- development and testing on synthetic data, never copies of production.
HIPAA, CCPA/CPRA and state privacy laws are covered in the US guide; our patient portal case study shows how a HIPAA-aligned build was structured for a US clinic network.