Plan your rider-data requirements before onboarding.
The Motrix HIPAA environment is paused and is not accepting PHI onboarding. This page describes the retained application safeguards and the reference hosting design to review before a future resumption.
Separate application safeguards from hosting readiness
The active standard-tier application uses DreamHost shared hosting. The retained HIPAA reference design uses dedicated AWS EC2 and RDS hosting. It is not a verified live environment today, and a standard-tier trial does not provide a PHI onboarding environment.
| Area | Documented HIPAA design | Before onboarding |
|---|---|---|
| Hosting and agreements | Dedicated AWS hosting with a Business Associate Agreement. | Resume hosting, verify service coverage, and execute the agency agreement. |
| Authentication | Mandatory TOTP two-factor authentication for every role and a 15-minute idle timeout. | Verify configuration and enroll each user. |
| Record access | Company-scoped permissions and an append-only six-year client-record access log. | Validate permissions and audit evidence for the deployment. |
| Storage and recovery | Encrypted AWS storage, encrypted off-box backups, and private database access. | Revalidate hosting controls and perform a logged restore drill. |
| Inspection drafts | Device-local draft storage disabled on the HIPAA tier. | Confirm device policies and authorized download handling with your IT team. |
The v2.15.1 release (September 9, 2026) also adds fail-closed rider-record reads, audited document downloads, and stronger retention guards to the retained HIPAA configuration. Because HIPAA hosting is paused, these are not claims of a verified live HIPAA environment.
Client Code mode for workflows without rider identities
Agencies can use opaque rider codes while retaining their name-to-code crosswalk on their own systems. Enable Client Code mode before entering client data. It is designed for reporting without stored rider identities, not address-based dispatch with real names and addresses.
Changing existing records to Client Code mode permanently scrubs identifying fields. Review this decision with your agency before making the change. Rider-data handling also depends on what your team enters or attaches elsewhere in the application.
Questions for your onboarding review
Is the HIPAA tier available for onboarding?
No. The HIPAA environment is currently paused. Hosting controls, agreements, backups, and operational readiness must be verified before PHI onboarding resumes. Do not enter PHI in the standard-tier trial.
What must happen before the tier resumes?
Motrix must resume and verify hosting, execute the agency Business Associate Agreement, complete a Security Risk Assessment, perform and log a backup restore drill, and remove demo data and known-credential accounts.
Can we use Client Code mode instead?
Client Code mode stores opaque rider codes while your agency keeps the identity crosswalk locally. Enable it before entering client data. Switching existing records to this mode permanently removes identifying fields; it does not provide address-based dispatch with real rider identities.
What does the access log record?
The documented application logs successful access to clients, trips, runs, and attendance reports, including views, changes, and exports. Entries identify the user, record, action, and time without copying rider names or addresses into the log. The append-only trail has a documented six-year retention period.
Do inspection drafts work on the HIPAA tier?
Device-local inspection drafts are disabled in the HIPAA configuration, and authenticated pages are not cached for offline use. This does not prevent users from taking screenshots or downloading authorized files.
Discuss scope, timing, and deployment requirements
Previously published HIPAA pricing was $750–1,000/month plus $1,500–3,000 for onboarding. These figures are indicative while the tier is paused; confirm availability, scope, and terms before budgeting or committing.
Bring your privacy and IT requirements so we can identify the controls and evidence needed before onboarding. See the commercial plans and tier status or the IT review guide.