Is Strapi HIPAA Compliant? Strapi Cloud, Enterprise Audit Logs, and Self-Hosting (2026)

Last updated: September 14, 2026

Strapi is not HIPAA compliant on its own, and no CMS is. HIPAA regulates the organizations that handle patient data, not the software they install. Strapi, Inc. holds a SOC 2 Type 2 report, but none of its public pages offers a Business Associate Agreement (BAA) as of September 14, 2026. That shapes the whole answer. A Strapi HIPAA compliant setup today means self-hosted Strapi 5 on a host that signs a BAA. It also means the right admin settings, an audit trail, and a patched version. Strapi Cloud cannot hold patient data without that contract. This guide covers what Strapi gives you, what costs extra, and what you still own. One note first: search results often mix Strapi with Stripe, the payments company. This page is about Strapi, the open-source headless CMS.

TL;DR: Quick answer

• Strapi Cloud costs $35, $90, or $450 per month. Its pricing and security pages claim SOC 2 and GDPR, but mention no HIPAA support or BAA.

• Self-hosted Strapi is free on the Community plan. Growth is $45 per month for 3 seats. Enterprise is custom-priced.

• Audit logs and review workflows need the Enterprise plan. Audit logs keep 90 days by default, then delete automatically.

• Role-based access control with field-level permissions is free on every plan. There is no built-in field encryption and no global rate limiter, so a Strapi HIPAA compliant build adds both.

• Strapi 4 stopped getting security fixes on April 30, 2026. A May 2026 flaw let attackers take over admin accounts, so run Strapi 5.37.0 or later.

Is Strapi HIPAA compliant? The three-layer answer

A Strapi HIPAA compliant system has three layers, and each one needs an owner. The first is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. Our HIPAA business associate agreement guide explains what it must say. The second layer is the server. The host runs the physical safeguards. It also runs disk encryption, firewalls, backups, and patching. The third layer is your Strapi project and your team. The HIPAA Security Rule lists five technical safeguards in 45 CFR § 164.312. They are access control, audit controls, integrity, person or entity authentication, and transmission security. Strapi gives you good tools for some and nothing for others. That uneven split is the heart of every Strapi HIPAA compliant plan. You also run a risk analysis under 45 CFR § 164.308(a)(1). A SOC 2 report does not replace any of these layers. SOC 2 is an audit of a vendor's controls. A BAA is the contract HIPAA requires. Why no badge settles the question is covered in HIPAA certified hosting.

What does Strapi 5 give you for the HIPAA technical safeguards?

Here is how Strapi 5 maps to each rule in 45 CFR § 164.312. The middle column is what ships with Strapi. The last column is what a Strapi HIPAA compliant project still needs from you or your host.

Two gaps stand out. First, Strapi has no built-in encryption for content fields. Its ENCRYPTION_KEY only controls whether admins can view API tokens again after creation. So audit logging and encryption both lean on the host for most teams. Second, the cors middleware's documented default origin is "*", which accepts any site. Set an explicit list before any patient-facing app calls your API. It takes five minutes and closes a real Strapi HIPAA compliant gap. Both gaps are why a Strapi HIPAA compliant build depends so much on where it runs.

Does Strapi Cloud sign a BAA?

Not on any page we could find. We checked Strapi's cloud pricing, self-hosted pricing, security page, and the Enterprise license agreement dated March 18, 2026. Each one names SOC 2 or GDPR. None mentions HIPAA, PHI, or a Business Associate Agreement. Strapi's docs describe Strapi Cloud as a fully managed content platform. They do not name the cloud provider underneath. A Strapi HIPAA compliant review needs that detail, so it has to come from Strapi directly. If you need Strapi HIPAA compliant hosting, ask Strapi's sales team in writing before you assume anything. Here is the full plan line as published on September 14, 2026.

Strapi's SOC 2 Type 2 news dates to June 25, 2024. The report is available on request through its trust center. That is useful for a vendor review. It is not a BAA, and it does not let PHI live on Strapi Cloud. The self-hosted plans are software licenses, not hosting. With self-hosting, the host you pick is the business associate. That is the only route to a Strapi HIPAA compliant deployment we can document today.

Which Strapi features need the Enterprise plan?

The ones auditors ask about first. Pricing decides a lot of Strapi HIPAA compliant plans. Strapi's self-hosted pricing page lists audit logs and review workflows as Enterprise-only. SSO is included in Enterprise, or sold as a $150 per month add-on for Growth. Content history on Growth keeps 14 days. The audit logs record content type changes, entry edits, publishing, media changes, logins and logouts, and role and user changes. That is a solid trail. But the default retention is 90 days, set by auditLogs.retentionDays, and older logs are deleted for good. HIPAA's documentation rule in 45 CFR § 164.316(b)(2)(i) requires six years for required records. Many organizations keep audit records that long too. So a Strapi HIPAA compliant plan should raise the retention setting, export the logs, or keep host-level logs for the long term. Record whichever you choose in your HIPAA risk analysis.

The 9 settings that make a Strapi project HIPAA-ready

These are the first settings we check in Strapi HIPAA compliant reviews. Each one comes from Strapi's own docs.

1. Upgrade to Strapi 5.45.0 or later. That covers the May 2026 fixes, including the Critical admin takeover flaw fixed in 5.37.0.

2. Inject secrets from your CI tool. Strapi's docs say never to commit APP_KEYS, API_TOKEN_SALT, ADMIN_JWT_SECRET, JWT_SECRET, TRANSFER_TOKEN_SALT, or ENCRYPTION_KEY in a .env file.

3. Strip the Public role. Any request without a token gets Public permissions by default. Remove every PHI content type from it.

4. Set admin session limits. The admin idle timeout defaults to 1 hour and the maximum session to 30 days. Shorten both to match your logoff policy.

5. Use refresh mode for end users. Users and Permissions issues 30-day JWTs in its default legacy mode. The refresh mode uses short-lived access tokens instead.

6. Expire API tokens. Tokens can last 7, 30, or 90 days, or never. Never pick Unlimited for a token that can read PHI.

7. Set an explicit CORS origin list. Replace the "*" default with the exact domains of your apps.

8. Add a global rate limit. Strapi limits only login and registration routes. Put a rate limit on the whole API at your proxy or firewall.

9. Keep an audit trail for six years. Use Enterprise audit logs with a longer retention value, or keep request and database logs at the host.

Item 4 is the automatic logoff rule in 45 CFR § 164.312(a)(2)(iii), explained in HIPAA automatic logoff. With these nine in place, the Strapi HIPAA compliant work inside your project is mostly done.

Where do Strapi projects leak PHI?

Usually through the API, not the admin panel. That is where Strapi HIPAA compliant reviews spend most of their time. A headless CMS exists to send content to other apps, so every open door is on the API side. These are the leaks we see most.

• The Public role. A content type left readable by Public is readable by anyone who guesses the URL.

• Old versions. Before 5.37.0, attackers without a login could pull password reset tokens through relational filters. Strapi rated it Critical, 9.2.

• CORS. Before 5.20.0, default installs reflected untrusted origins. That flaw, CVE-2025-53092, was rated High.

• Unsupported databases. Strapi's docs say Amazon Aurora and Google Cloud SQL are not supported. Pick a supported PostgreSQL or MySQL setup, as covered in HIPAA compliant database hosting. On AWS, the engine settings are in is Amazon RDS HIPAA compliant.

• Email and uploads. Email providers and media storage need their own BAAs. Keep PHI out of email bodies.

Patient-facing front ends add their own risks. The build order for those is in HIPAA compliant patient portal.

What does HIPAA hosting for Strapi cost in 2026?

A Strapi HIPAA compliant budget starts with a host that signs a BAA. Strapi Cloud does not list one, so it cannot carry PHI at any price. Figures are as published on September 14, 2026.

We sell the last row, so weigh it as a disclosure. Our Strapi plans start at $299 rather than $249 for a reason. They run on memory-optimized servers with 16 GB of RAM at the smallest size. Strapi's own docs recommend 4 GB or more, and patient apps grow. Headroom keeps a Strapi HIPAA compliant API fast under load. If you are comparing Heroku, Render, or Vercel for the front end, we check each one in HIPAA compliant app hosting.

If you would rather not run the server layer yourself

Most Strapi teams want to model content, not patch Node.js at midnight. Our HIPAA compliant Strapi hosting runs self-hosted Strapi on single-tenant AWS. CloudFront and a web application firewall sit in front of every plan. We run the AWS account, the network, the operating system, the Node.js runtime, the database, and TLS. We also run encryption, audit logging, backups, and monitoring. You run your Strapi project, content types, plugins, roles, and API tokens. Strapi version upgrades stay with you unless we scope them together. That split keeps the Strapi HIPAA compliant duties clear on both sides. The BAA is signed within 24 hours, before any patient data moves. Plans start from $299 per month with migration included. We sell this, so weigh it as a disclosure.

Here is the honest inverse. Many healthcare teams use Strapi only for public content, such as service pages, provider bios, and blog posts. If no PHI ever flows through your Strapi API, HIPAA does not apply to it. In that case Strapi Cloud at $35 per month is a fine choice, and you do not need us. If that public site runs on WordPress instead, see is WordPress HIPAA compliant. If your team already runs AWS under AWS's BAA with an engineer who owns patching and logs, that works too. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what your API serves and get a straight answer.

Frequently asked questions

Is Strapi HIPAA compliant?

No CMS is HIPAA compliant by itself. A Strapi HIPAA compliant system needs self-hosted Strapi on a host that signs a BAA. It also needs locked-down roles, short sessions, expiring tokens, an audit trail, and a patched version. Strapi, Inc. lists no BAA for Strapi Cloud as of September 14, 2026.

Does Strapi Cloud sign a BAA?

Not publicly. Strapi's pricing, security, and Enterprise license pages name SOC 2 and GDPR but never HIPAA or a BAA, as of September 14, 2026. Without a signed BAA, Strapi Cloud cannot store or process PHI. Ask Strapi's sales team in writing if you need a firm answer.

Are Strapi audit logs enough for HIPAA?

They are a strong start, but only on the Enterprise plan. They record content edits, logins, and role changes. The default retention is 90 days, after which logs are deleted. Raise auditLogs.retentionDays, export the logs, or keep host logs for the long term.

Which Strapi features need the Enterprise plan?

Audit logs and review workflows are Enterprise-only on the self-hosted pricing page. SSO is included in Enterprise or costs $150 per month on Growth. Roles with field-level permissions are free on every plan, including Community.

Is Strapi 4 still safe to run?

No. Strapi 4 stopped getting security fixes on April 30, 2026. Any new flaw found after that date stays open on version 4. Move to Strapi 5 and stay current, at least 5.45.0 for the May 2026 fixes.

Recap: Strapi HIPAA compliant

To recap, a Strapi HIPAA compliant setup is self-hosted Strapi 5 on a host that signs a BAA. Strapi Cloud lists SOC 2 and GDPR but no BAA, so it is not a PHI route today. Strapi gives you free roles with field-level permissions, admin login limits, and expiring tokens. Audit logs and review workflows need Enterprise, and audit logs keep only 90 days unless you change it. There is no field encryption and no global rate limiter. Run 5.45.0 or later, strip the Public role, set CORS, shorten sessions, and keep audit records for six years.

This article is general information, not legal advice. Plans, prices, BAA terms, and support dates change often. The details here reflect Strapi's public pricing, security, legal, and documentation pages and GitHub advisories as read on September 14, 2026. Confirm current terms with Strapi, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed September 2026.

Sources

• Strapi: Strapi Cloud pricing and Self-hosted pricing.

• Strapi: Security and Enterprise Software License Agreement (effective March 18, 2026).

• Strapi blog: SOC 2 certification (June 25, 2024).

• Strapi docs: RBAC, Audit logs, Users and Permissions, API tokens.

• Strapi docs: Admin panel configuration, Middlewares, Installation requirements, Deployment, Strapi Cloud.

• Strapi: May 2026 security disclosure and Strapi 4 end of support notice.

• GitHub advisories: CVE-2026-27886 and CVE-2025-53092.

• 45 CFR § 164.312 (technical safeguards): law.cornell.edu.

• 45 CFR § 164.316 (documentation retention): law.cornell.edu.

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.

• 45 CFR § 160.103 (definitions): ecfr.gov.