Skip to main content

HIPAA Compliant Strapi Hosting

We run self-hosted Strapi for healthcare product and content teams on a single-tenant AWS environment, with the Business Associate Agreement signed within 24 hours on managed tiers. Managed tiers from $299/mo.

See tiers and pricing Request a quote

Why self-hosted Strapi, on a host that signs a BAA

A headless CMS that serves patient-facing apps and portals is part of the system that handles PHI, and its API is the front door.

Your content API is in the data path

When a mobile app or patient portal reads from Strapi, the content, the users and the API tokens all live on the server. That server needs to be BAA-covered and isolated.

Self-hosted keeps the data in your environment

Running Strapi on a single-tenant AWS environment keeps the database, uploads and admin panel inside infrastructure dedicated to you, behind CloudFront and a WAF.

Memory-optimised for Node.js and the database

Strapi runs on our R-class tiers: r8g instances with 16 GB of RAM at Solo, room for the Node.js process, the database and the admin build side by side.

Healthcare data protection controls around a Strapi content API

The content API, its database and its uploads stay inside infrastructure dedicated to you, behind CloudFront and a WAF.

Where our responsibility ends

Stated plainly, because knowing this before an incident is worth more than discovering it during one.

We run

  • The AWS account, VPC and network isolation
  • The operating system, patching and hardening
  • The Node.js runtime, the database, the process manager and TLS
  • CloudFront, the WAF, encryption, audit logging and backups
  • Monitoring and infrastructure incident response

You run

  • Your Strapi project, content types, plugins and customisations
  • Strapi version upgrades, unless scoped with us
  • Content, admin users, roles and API tokens
  • The apps and systems that consume your API, and the data you expose to them

If a problem turns out to be the server, the runtime or the infrastructure, open a ticket and we take it. If it is inside your Strapi project, we tell you what we found and hand it back with recommendations.

Strapi hosting tiers

Five sizes, Solo to Network. Monthly and annual pricing published here; three-year pricing at the store.

Strapi hosting tiers: capacity, included transfer and monthly price
Tier Instance vCPU RAM Storage + backups Transfer Monthly Annual Buy
Solo r8g.large 2 16 GB 100 GB + 100 GB 150 GB $299/mo $3,409/yr Order Solo
Practice r8g.xlarge 4 32 GB 200 GB + 200 GB 300 GB $499/mo $5,689/yr Order Practice
Clinic r8g.2xlarge 8 64 GB 400 GB + 400 GB 600 GB $899/mo $10,249/yr Order Clinic
Group r8g.4xlarge 16 128 GB 600 GB + 600 GB 1,000 GB $1,699/mo $19,369/yr Order Group
Network r8g.8xlarge 32 256 GB 800 GB + 800 GB 1,500 GB $3,299/mo $37,609/yr Order Network

Managed tiers from $299/mo. Every tier is single-tenant AWS on ARM (Graviton) instances with snapshot retention, encryption and audit logging. Three-year pricing is available at the Strapi store page.

What every Strapi tier includes

The same compliance baseline at Solo and at Network. Capacity is the only thing that changes.

  • Single-tenant AWS environment
  • CloudFront CDN in front of every tier
  • Web application firewall
  • EBS storage with 7-day snapshot retention
  • Encryption at rest and in transit
  • Six-year audit logging
  • Tested, encrypted backups
  • Migration included
  • BAA signed within 24 hours of signup
  • 24/7 team, monitoring and infrastructure incident response

HIPAA hosting vs standard hosting

A $10 shared plan is not slightly less compliant; it is categorically different. Most mainstream hosts will not sign a BAA for shared hosting at any price.

Signed BAA before any PHI arrives
Standard Hosting
Not included
HIPAA Compliant
Included
Single-tenant isolation
Standard Hosting
Not included
HIPAA Compliant
Included
Encryption on by default, at rest and in transit
Standard Hosting
Not included
HIPAA Compliant
Included
Audit logs centralized and kept six years
Standard Hosting
Not included
HIPAA Compliant
Included
Encrypted backups with tested restores
Standard Hosting
Not included
HIPAA Compliant
Included
Written responsibility split
Standard Hosting
Not included
HIPAA Compliant
Included

HIPAA Strapi hosting FAQ

Is Strapi HIPAA compliant?
Strapi itself is neither compliant nor non-compliant; software is neutral and the stack it runs on decides. A Strapi site becomes part of a compliant system when the host signs a Business Associate Agreement (45 CFR § 164.308(b)) and the environment carries the Security Rule safeguards: encryption, access controls, audit logging and tested backups. Strapi's role-based API permissions handle the application half; our tiers supply the infrastructure half.
Do you sign a BAA for Strapi hosting?
Yes, on every managed tier, within 24 hours of signup and always before any patient data moves to us. Coverage begins at signature, not at migration.
Can we keep using Strapi Cloud?
Strapi Cloud is a shared, multi-tenant platform operated by a third party. Self-hosting on a single-tenant environment under our BAA keeps the content database, uploads and tokens inside infrastructure dedicated to you, which is what a covered entity or business associate can document and audit.
Why do these tiers start at $299 instead of $249?
Strapi runs on the R-class tiers: memory-optimised r8g instances with 16 GB of RAM at Solo, twice the M-class baseline, because database-heavy workloads perform and scale better with the headroom. M-class platforms such as WordPress and Joomla start at $249.
Which tier do we need?
Solo suits a single content API behind one app or site. Practice adds capacity for several front ends, heavier media libraries or more editors. Clinic, Group and Network scale to multi-site networks and higher traffic; if you are unsure, tell us what the site does and we will size it with you.

Guides that go with this page

The contract, the hosting layer, and the cloud underneath it.

Building on Strapi for a healthcare product?

Tell us what consumes the API and we will tell you which tier fits.

Request a Quote Contact Us