Immutable record
Entries are append-only. Nothing is overwritten, so the history of every dollar stays intact and auditable.
Trust & security
Legal & regulatory posture:built around zero custody.
ChicLedger's architecture reflects the experience of founders who have worked on the legal and regulatory front lines of healthcare and fintech.
What ChicLedger does not do
- Hold claim reserves or exchange client moneyFunds move between the parties' own accounts. ChicLedger sends instructions and records the result; it never takes custody.
- Access protected health informationThe ledger carries financial data only. We don't receive diagnoses, treatment details or medical records.
- Adjudicate or authorize paymentClaim decisions stay with the TPA, always.
- Receive member-level dataNo census files, names, Social Security numbers, dates of birth or eligibility rosters. Member data stays in the TPA's systems; transactions match on one-way anonymized tokens.
- Take a fee from a standard claimStandard settlements reach the hospital at 100% of face value. A fee applies only if a hospital opts into ChicLedger Assurance.
What ChicLedger is designed to do
- Operate as zero-custody infrastructureA record-keeping and payment-instruction layer that never takes possession of funds.
- Role-based access, encrypted data and strict third-party vendor controlsEvery party sees only its own records. Data is encrypted in transit and at rest.
- Align to the FTC Safeguards RuleOur information security program is designed around its requirements.
- SOC 2 alignment in progressWe are building our controls toward a SOC 2 examination.
Principles
Proof, not promises.
Least-privilege access
Employers, TPAs and providers each see their own slice of the shared record, and nothing more.
Data minimization
We collect only the financial data the ledger needs, and we keep health information out of it entirely.
Standards
Designed to the frameworks your procurement team asks about.
| Framework | Why it matters | How ChicLedger approaches it |
|---|---|---|
| SOC 2 Type II | Enterprise procurement | Access controls and audit logging designed to the standard from day one; examination in preparation. |
| HIPAA | Health data protection | Addressed structurally: no patient-identifiable data enters the ledger, at any stage. |
| PCI DSS | Payment instruction flows | ChicLedger stores no card data. |
| ISO 27001 / NIST CSF | Institutional trust | Security program aligned to both frameworks. |
| FTC Safeguards Rule | Customer financial information | Information security program designed around its requirements. |
Security questions
Due diligence welcome.
We're happy to walk your security, compliance and legal teams through our architecture and controls. If you believe you've found a security vulnerability, please tell us and we'll respond promptly.
- Security & compliance enquiriesinfo@chicledger.com
- PrivacyRead our privacy policy