1. Executive Summary & Zero-Retention Model

Stanza Infrastructure operates a portfolio of high-velocity microservices running on Cloudflare Workers global Anycast edge isolates across 330+ data centers. Every microservice operates under a strict Zero Data Retention ($f(x)=y$) Ephemeral Compute Architecture.

• 0 Bytes of Request Payloads Stored: Inbound transactional data exists solely in transient V8 isolate RAM for the milliseconds required to compute arithmetic transformations, after which it is immediately garbage collected.
• 0 Database Writes for Payload Processing: No relational databases, document stores, or S3/R2 storage buckets are attached to hot payload pipelines.
• 0 External Subrequests: Processing is 100% deterministic pure compute. The worker cannot leak data through third-party outbound network calls.

2. Cryptography & Data in Transit

All network communication strictly mandates TLS 1.3 encryption with strict modern AEAD cipher suites (TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256). HTTP Strict Transport Security (HSTS) is enforced with 1-year preloading.

Authentication uses SHA-256 constant-time XOR folding to prevent side-channel timing attacks across all platform API keys and edge rate-limit bindings.

3. HIPAA PHI & GDPR DPA Compliance Status

Not yet HIPAA compliant — do not route live PHI through the platform. Transient in-memory processing of ANSI X12 837 claims or 835 remittances avoids persistent storage by design, but the formal HIPAA compliance program (risk assessment, BAA execution, third-party audit) is still in progress. Process only synthetic, test, or de-identified payloads until compliance is announced here.

Two-plane separation: the public edge (api.stanzaapi.com) is synthetic-data only. Live ePHI under an executed BAA routes exclusively to secure.api.stanzaapi.com — an AWS API Gateway custom domain published DNS-only (unproxied) with TLS terminated on AWS. No Cloudflare Worker route may capture the secure host.

European Union data sovereignty is supported via Anycast routing executing directly in European Union Cloudflare data centers (Frankfurt, Paris, Amsterdam). A GDPR Article 28 DPA is in progress — contact us for current status before routing EU personal data.

4. Infrastructure Resilience & SLA Commitment

All micro-APIs carry a contractually backed 99.9% Uptime Service Level Agreement backed by Cloudflare's Anycast network. Denial of Service (DDoS) protection absorbs multi-terabit volumetric traffic before it reaches compute isolates.