Compliance and BAAs

The architecture was designed so a regulated deployment (healthcare being the obvious call-center vertical) is a configuration change, not a rebuild. This page documents that path: which vendor covers what, the one-env-var LLM switch that keeps model traffic inside a single agreement, and the honest gap list a regulated deployment must still close.

Framing, stated plainly: this is engineering documentation, not legal advice, and it describes what the architecture supports. Elle as deployed is a portfolio assistant: she handles no PHI, no BAAs are signed, and none need to be. The point of this page is that when a deployment does need them, the seams are already in the right places.

The BAA chain, vendor by vendor

A BAA covers PHI only when three things are true at once: the agreement is signed, the specific service is on that vendor's covered list, and it is used per their configuration rules. Miss any one and the data sits outside the agreement. Component by component:

Layer	Provider	Coverage mechanism
Compute, secrets, storage, logs	GCP (Cloud Run, Secret Manager, GCS, Logging)	All under the one GCP BAA the project owner accepts.
LLM	Claude via Vertex AI	The keystone: `LLM_PROVIDER=vertex` routes the same Claude models through a Google Cloud service, so model traffic falls under the same GCP BAA as the compute. No separate model-vendor agreement, one security perimeter. Auth is service-account ADC, so no API key exists to leak.
Speech (STT + TTS)	Deepgram	Deepgram signs BAAs; one agreement covers both the streaming STT and Aura TTS legs.
Telephony	Twilio	Twilio publishes HIPAA-eligible services; a regulated deployment must confirm Voice and Media Streams are on the covered list under its BAA. Plain SMS is not a PHI channel and the design never requires it to be: texts here are scheduling logistics.
Demo mode (fused voice)	OpenAI Realtime	Requires OpenAI's BAA (requested via baa@openai.com) plus a zero-data-retention configuration before any PHI. Absent that, demo mode stays a non-PHI showpiece; the runtime switch makes that a policy you can actually enforce.

The perimeter, drawn

GCP BAA perimeterCloud Run · Secret Manager · GCS · Logging · Vertex AI (Claude): one agreement covers all of it

↕ covered traffic only

Deepgramown BAA · STT + TTS

Twilioown BAA · HIPAA-eligible voice services

OpenAI Realtimedemo mode: BAA + ZDR required,
else no PHI ever

Three agreements total for a regulated cascade deployment: GCP, Deepgram, Twilio. The Vertex switch is what keeps the count at three instead of four.

Why the Vertex switch is the interesting part

The direct Anthropic API endpoint and the Vertex endpoint serve the same models through the same shared message transforms (src/llm/anthropicShared.ts), so behavior is identical; only the client and auth differ, and npm run verify:vertex proves the wiring offline. What changes is jurisdictional: a consumer endpoint is not on any covered list, while Vertex is a Google Cloud service inside the agreement you already signed for the compute. Same brain, different legal perimeter, one environment variable:

.env · the whole switch

LLM_PROVIDER=vertex
VERTEX_PROJECT_ID=<your project>
VERTEX_REGION=us-east5
VERTEX_MODEL=<exact Model Garden id for that region>

Recording: compliant by construction, off by default

Call recording (src/recording/) was built app-side deliberately: the audio already flows through the bridge, so recordings are assembled in-process and uploaded to a GCS bucket in the same project. No Twilio recording product, no third-party processor, no audio leaving the perimeter, and no per-minute recording fees. It ships disabled because recording is a consent decision before it is a technical one: enabling it requires the spoken notice in the greeting (wired via recordingNotice()) and honoring two-party-consent law for callers in states that require it.

The honest gap list

What a regulated deployment must still do; none of it is architectural, all of it is work:

Gap	Today (portfolio deployment)	Regulated requirement
Transcript logging	Caller utterances appear in `[voice]` log lines for debugging	Silence or scrub conversation content from application logs; keep transcripts only in covered storage.
Database	SQLite on the instance	Cloud SQL or Firestore under the GCP BAA, with retention and deletion policies.
Admin views	Token-guarded, timing-safe	Front with IAP or SSO and audit access; a static token is not an access-control story for PHI.
Retention	Indefinite (nothing sensitive stored)	Written retention schedule for transcripts, recordings, and facts.
Agreements	None signed, none needed	GCP + Deepgram + Twilio BAAs executed before the first PHI call.

Where this meets the economics

Regulated verticals are where the volume economics and this page intersect: healthcare call centers sit deep in the fleet-wins regime, and the compliance posture above is compatible with every architecture band, because the Vertex switch, the app-side recorder, and the provider seams were placed before scale ever demanded them. The security page covers the perimeter controls that apply regardless of regulation.