Public website
Use HTTPS/TLS, HSTS, secure cookies, security headers, bot protection and rate limiting on public forms.
Client portal
Authenticated client accounts should use MFA and role-based access, with PHI handled only through vendors and systems covered by appropriate BAAs.
Payments
If online payments are enabled, redirect users to the selected processor’s hosted checkout so full card numbers and CVV values do not touch J&T’s website.
Incident and retention controls
Production policies should define logging, incident response, minimum-necessary data, retention and vendor management.