Skip to main content

HIPAA Compliant Phalcon Hosting

We run Phalcon applications for healthcare teams on a single-tenant AWS environment, with the Business Associate Agreement signed within 24 hours on managed tiers. Managed tiers from $229/mo.

See tiers and pricing Request a quote

How your service fits together

Separate the Phalcon runtime from your application

Which Phalcon and PHP versions must the runtime provide, and when can they change?

1

High-volume clients and integrations

Your users, application choices and external services determine what needs to connect.

Inside your dedicated hosting environment

2

Your application on the Phalcon extension

Confirm application maintenance, access and deployment responsibilities during scoping.

3

Application database and caches

Hosting includes encryption, audit logging and tested backups. Plan capacity follows your workload.

Illustrative operating model. Your final architecture and responsibilities are agreed during scoping. Connected applications and services need their own review; a hosting agreement does not establish their suitability.
Discuss your Phalcon architecture

Why Phalcon needs a HIPAA host, not a generic one

Phalcon is delivered as a compiled extension to PHP itself, which makes it faster than most and puts part of your framework inside the runtime we manage.

The framework lives in the runtime

Because Phalcon is a PHP extension rather than a package in your project, keeping it present and current is a server concern rather than a composer one. That is on our side of the line, and it is worth knowing which side that is.

Throughput without shared tenancy

Phalcon is usually chosen for volume: eligibility checks, claims processing, high-traffic APIs. Handling volume on infrastructure dedicated to you means performance work never becomes an argument for sharing a host.

The same baseline, at speed

Encryption, WAF, audit logging, backups and monitoring are configured before handover regardless of how fast the application needs to be. Performance is a capacity question; the safeguards are not negotiable against it.

Where our responsibility ends

Stated plainly, because knowing this before an incident is worth more than discovering it during one.

We run

  • The AWS account, VPC and network isolation
  • The operating system, patching and hardening
  • PHP and the Phalcon extension, the web server, the database and TLS
  • CloudFront, the WAF, encryption, audit logging and backups
  • Monitoring and infrastructure incident response

You run

  • Your Phalcon application and its code
  • Application-level dependency updates, unless scoped with us
  • Authentication, authorisation and what your code does with PHI
  • The systems your application integrates with and the data you send them

If a problem turns out to be the server, the PHP runtime, the Phalcon extension or the infrastructure, open a ticket and we take it. If it is inside your application, we tell you what we found and hand it back with recommendations.

HIPAA hosting vs standard hosting

A $10 shared plan is not slightly less compliant; it is categorically different. Most mainstream hosts will not sign a BAA for shared hosting at any price.

Signed BAA before any PHI arrives
Standard Hosting
Not included
HIPAA Compliant
Included
Single-tenant isolation
Standard Hosting
Not included
HIPAA Compliant
Included
Encryption on by default, at rest and in transit
Standard Hosting
Not included
HIPAA Compliant
Included
Audit logs centralized and kept six years
Standard Hosting
Not included
HIPAA Compliant
Included
Encrypted backups with tested restores
Standard Hosting
Not included
HIPAA Compliant
Included
Written responsibility split
Standard Hosting
Not included
HIPAA Compliant
Included

Phalcon hosting tiers

Every tier is a single-tenant AWS account with a signed BAA and the same compliance baseline. What changes is capacity.

Help me choose a hosting tier

Choose capacity for your workload, rather than the size of your organization. The published tiers share the compliance baseline described above.

CPU and memory
Consider concurrent requests, background jobs, database work and your application's memory needs. Traffic alone does not tell the whole story.
Storage and backups
Allow room for your application, database, uploads and expected growth. Compare the listed live-storage and backup allocations separately.
Data transfer
Estimate outgoing data from page visits, downloads and integrations, then compare it with the included transfer.
When to size up or scope a custom setup
Review capacity when monitoring shows sustained resource pressure or you expect a workload increase. Availability and recovery goals may require architecture changes, not simply a larger server.

Unsure where to start? Share the requirements you know. An engineer can help you choose an existing tier or scope a custom configuration.

Discuss Phalcon capacity with an engineer

  • Starter

    $229/mo

    or $2,611/yr

    Compute
    1 vCPU
    Memory
    2 GB
    Storage
    50 GB
    Backups
    100 GB
    Transfer
    250 GB
    Order Starter

  • Solo

    $399/mo

    or $4,549/yr

    Compute
    2 vCPU
    Memory
    4 GB
    Storage
    100 GB
    Backups
    200 GB
    Transfer
    500 GB
    Order Solo

  • Practice

    $599/mo

    or $6,829/yr

    Compute
    4 vCPU
    Memory
    8 GB
    Storage
    200 GB
    Backups
    400 GB
    Transfer
    1,000 GB
    Order Practice

  • Clinic

    $999/mo

    or $11,389/yr

    Compute
    8 vCPU
    Memory
    16 GB
    Storage
    400 GB
    Backups
    800 GB
    Transfer
    2,000 GB
    Order Clinic

  • Group

    $1,799/mo

    or $20,509/yr

    Compute
    16 vCPU
    Memory
    32 GB
    Storage
    600 GB
    Backups
    1200 GB
    Transfer
    3,000 GB
    Order Group

  • Network

    $3,299/mo

    or $37,609/yr

    Compute
    32 vCPU
    Memory
    64 GB
    Storage
    800 GB
    Backups
    1600 GB
    Transfer
    5,000 GB
    Order Network

What every Phalcon tier includes

The same compliance baseline at Solo and at Network. Capacity is the only thing that changes.

  • Single-tenant AWS environment
  • CloudFront CDN in front of every tier
  • Web application firewall
  • EBS storage with 7-day snapshot retention
  • Encryption at rest and in transit
  • Six-year audit logging
  • Tested, encrypted backups
  • Migration included
  • BAA signed within 24 hours of signup
  • 24/7 team, monitoring and infrastructure incident response

Know who owns the next step

Clear scope matters before launch and when you need help.

Hosting operations

Our published managed-hosting baseline includes 24/7 monitoring and infrastructure incident response, patching, logging and tested backups. Application changes and third-party integrations depend on the agreed scope.

Customer support route

Before you commit

Review the BAA, responsibility split, backup and recovery requirements, migration steps and support contacts with us. Tell us which procurement documents your organization needs so we can confirm what is available.

Review scope and documentation

Planning a new service

Quotes and general inquiries use our contact process during business hours. Existing customers should use their account's support instructions for infrastructure incidents.

Contact the team

Phalcon hosting questions

Who keeps the Phalcon extension up to date?
We do, because it is part of the PHP runtime rather than part of your project. That is the main operational difference between Phalcon and every other framework on this list, and it is worth being explicit about: a framework upgrade here is a server change, so it is coordinated with you rather than deployed by you.
Which Phalcon version do you run?
That is matched to your application and the supported PHP release underneath it, so it is a conversation at onboarding rather than a fixed number. What is fixed is that the PHP version will be one still receiving security fixes.
Does the performance focus change the compliance baseline?
No. Encryption, isolation, WAF, audit logging, backups and the Business Associate Agreement are identical across every platform and tier we run. Performance determines which tier fits, not which safeguards apply.

Find the right Phalcon setup

Tell us what you run, what you need to move and who manages the application. We will help you scope capacity and responsibilities before you choose a tier.

Discuss your Phalcon workload Compare tiers