Skip to main content

HIPAA Compliant Strapi Hosting

We run self-hosted Strapi for healthcare product and content teams on a single-tenant AWS environment, with the Business Associate Agreement signed within 24 hours on managed tiers. Managed tiers from $229/mo.

See tiers and pricing Request a quote

How your service fits together

Follow the data through your Strapi application

Which clients can access the API, and what data leaves it for other systems?

1

Web and mobile frontends

Your users, application choices and external services determine what needs to connect.

Inside your dedicated hosting environment

2

Strapi content API

Confirm application maintenance, access and deployment responsibilities during scoping.

3

Content database and uploads

Hosting includes encryption, audit logging and tested backups. Plan capacity follows your workload.

Illustrative operating model. Your final architecture and responsibilities are agreed during scoping. Connected applications and services need their own review; a hosting agreement does not establish their suitability.
Discuss your Strapi architecture

Why self-hosted Strapi, on a host that signs a BAA

A headless CMS that serves patient-facing apps and portals is part of the system that handles PHI, and its API is the front door.

Your content API is in the data path

When a mobile app or patient portal reads from Strapi, the content, the users and the API tokens all live on the server. That server needs to be BAA-covered and isolated.

Self-hosted keeps the data in your environment

Running Strapi on a single-tenant AWS environment keeps the database, uploads and admin panel inside infrastructure dedicated to you, behind CloudFront and a WAF.

Memory-optimised for Node.js and the database

Strapi runs on our memory-optimised tiers, with 16 GB of RAM at Solo, room for the Node.js process, the database and the admin build side by side.

Healthcare data protection controls around a Strapi content API

The content API, its database and its uploads stay inside infrastructure dedicated to you, behind CloudFront and a WAF.

Where our responsibility ends

Stated plainly, because knowing this before an incident is worth more than discovering it during one.

We run

  • The AWS account, VPC and network isolation
  • The operating system, patching and hardening
  • The Node.js runtime, the database, the process manager and TLS
  • CloudFront, the WAF, encryption, audit logging and backups
  • Monitoring and infrastructure incident response

You run

  • Your Strapi project, content types, plugins and customisations
  • Strapi version upgrades, unless scoped with us
  • Content, admin users, roles and API tokens
  • The apps and systems that consume your API, and the data you expose to them

If a problem turns out to be the server, the runtime or the infrastructure, open a ticket and we take it. If it is inside your Strapi project, we tell you what we found and hand it back with recommendations.

HIPAA hosting vs standard hosting

A $10 shared plan is not slightly less compliant; it is categorically different. Most mainstream hosts will not sign a BAA for shared hosting at any price.

Signed BAA before any PHI arrives
Standard Hosting
Not included
HIPAA Compliant
Included
Single-tenant isolation
Standard Hosting
Not included
HIPAA Compliant
Included
Encryption on by default, at rest and in transit
Standard Hosting
Not included
HIPAA Compliant
Included
Audit logs centralized and kept six years
Standard Hosting
Not included
HIPAA Compliant
Included
Encrypted backups with tested restores
Standard Hosting
Not included
HIPAA Compliant
Included
Written responsibility split
Standard Hosting
Not included
HIPAA Compliant
Included

Strapi hosting tiers

Every tier is a single-tenant AWS account on ARM with a signed BAA and the same compliance baseline. Compare capacity and deployment details for your workload.

Help me choose a hosting tier

Choose capacity for your workload, rather than the size of your organization. The published tiers share the compliance baseline described above.

CPU and memory
Consider concurrent requests, background jobs, database work and your application's memory needs. Traffic alone does not tell the whole story.
Storage and backups
Allow room for your application, database, uploads and expected growth. Compare the listed live-storage and backup allocations separately.
Data transfer
Estimate outgoing data from page visits, downloads and integrations, then compare it with the included transfer.
When to size up or scope a custom setup
Review capacity when monitoring shows sustained resource pressure or you expect a workload increase. Availability and recovery goals may require architecture changes, not simply a larger server.

Unsure where to start? Share the requirements you know. An engineer can help you choose an existing tier or scope a custom configuration.

Discuss Strapi capacity with an engineer

  • Starter

    $229/mo

    or $2,611/yr

    Compute
    1 vCPU
    Memory
    8 GB
    Storage
    50 GB
    Backups
    100 GB
    Transfer
    250 GB
    Order Starter

  • Solo

    $399/mo

    or $4,549/yr

    Compute
    2 vCPU
    Memory
    16 GB
    Storage
    100 GB
    Backups
    200 GB
    Transfer
    500 GB
    Order Solo

  • Practice

    $599/mo

    or $6,829/yr

    Compute
    4 vCPU
    Memory
    32 GB
    Storage
    200 GB
    Backups
    400 GB
    Transfer
    1,000 GB
    Order Practice

  • Clinic

    $999/mo

    or $11,389/yr

    Compute
    8 vCPU
    Memory
    64 GB
    Storage
    400 GB
    Backups
    800 GB
    Transfer
    2,000 GB
    Order Clinic

  • Group

    $1,799/mo

    or $20,509/yr

    Compute
    16 vCPU
    Memory
    128 GB
    Storage
    600 GB
    Backups
    1200 GB
    Transfer
    3,000 GB
    Order Group

  • Network

    $3,299/mo

    or $37,609/yr

    Compute
    32 vCPU
    Memory
    256 GB
    Storage
    800 GB
    Backups
    1600 GB
    Transfer
    5,000 GB
    Order Network

What every Strapi tier includes

Every offered tier includes these safeguards. Capacity and deployment architecture depend on the plan you choose.

  • Single-tenant AWS environment
  • CloudFront CDN in front of every tier
  • Web application firewall
  • EBS storage with 7-day snapshot retention
  • Encryption at rest and in transit
  • Six-year audit logging
  • Tested, encrypted backups
  • Migration included
  • BAA signed within 24 hours of signup
  • 24/7 team, monitoring and infrastructure incident response

Know who owns the next step

Clear scope matters before launch and when you need help.

Hosting operations

Our published managed-hosting baseline includes 24/7 monitoring and infrastructure incident response, patching, logging and tested backups. Application changes and third-party integrations depend on the agreed scope.

Customer support route

Before you commit

Review the BAA, responsibility split, backup and recovery requirements, migration steps and support contacts with us. Tell us which procurement documents your organization needs so we can confirm what is available.

Review scope and documentation

Planning a new service

Quotes and general inquiries use our contact process during business hours. Existing customers should use their account's support instructions for infrastructure incidents.

Contact the team

Strapi hosting questions

Is Strapi HIPAA compliant?
Strapi itself is neither compliant nor non-compliant; software is neutral and the stack it runs on decides. A Strapi site becomes part of a compliant system when the host signs a Business Associate Agreement (45 CFR § 164.308(b)) and the environment carries the Security Rule safeguards: encryption, access controls, audit logging and tested backups. Strapi's role-based API permissions handle the application half; our tiers supply the infrastructure half. Our Strapi HIPAA compliant guide covers Strapi Cloud's BAA status, Enterprise-only audit logs, and the nine settings to change first.
Do you sign a BAA for Strapi hosting?
Yes, on every managed tier, within 24 hours of signup and always before any patient data moves to us. Coverage begins at signature, not at migration.
Can we keep using Strapi Cloud?
Strapi Cloud is a shared, multi-tenant platform operated by a third party. Self-hosting on a single-tenant environment under our BAA keeps the content database, uploads and tokens inside infrastructure dedicated to you, which is what a covered entity or business associate can document and audit.
Why do these tiers cost more than a generic VPS?
Strapi runs on our memory-optimised tiers, with 16 GB of RAM at Solo, because the Node.js process, the database and the admin build all perform and scale better with that headroom.
Which tier do we need?
Solo suits a single content API behind one app or site. Practice adds capacity for several front ends, heavier media libraries or more editors. Clinic, Group and Network scale to multi-site networks and higher traffic; if you are unsure, tell us what the site does and we will size it with you.

Find the right Strapi setup

Tell us what you run, what you need to move and who manages the application. We will help you scope capacity and responsibilities before you choose a tier.

Discuss your Strapi workload Compare tiers