Crane Crane
Most staffing platforms bolt compliance on. Crane was designed from its first commit around five non-negotiable rules — and every one of them is enforced by code, proven by a test, and documented in the open.
The strongest data protection is data that isn't there.
Credential documents, license numbers, pay detail — even worker names — live in an AES-256-GCM vault with per-tenant keys, durable ciphertext at rest, and a HashiCorp Vault Transit option where key material never leaves your KMS. The marketplace graph holds relationships and opaque references, nothing else.
Crane's test suite literally sweeps every property of every node in the graph and asserts that no protected value appears. That test is a merge gate: a build that would leak PHI onto the marketplace cannot ship.
Who can see a worker's credential status is a graph question — employment, an active submission, or the worker's own explicit wallet share. No relationship, no read. And workers see the whole truth: everyone with access to their wallet, listed, revocable.
Alert fatigue doesn't survive a survey. Enforcement does.
Requirements derive from your accreditation regime (AAAHC, Joint Commission, state/CMS), state law, role, and unit — automatically, per shift. Nobody hand-types the ACLS requirement and nobody forgets it.
A worker missing any required credential — or holding one that lapses before shift end — cannot be submitted, and is re-checked at award, so a credential that expired in between never gets placed. There is no per-tenant switch to turn this off.
Primary-source verification on a re-check cadence; the board's expiry date outranks the hand-entered one. OIG/SAM exclusion feeds and public-list screening flag possible matches for human review — a confirmed hit blocks instantly and alerts everyone with a stake.
When the surveyor asks "how do you know?", you hand them a file, not a story.
Each credential-gate evaluation — including blocked attempts that never became submissions — is recorded with its timestamp and the exact requirements that were missing. Export any survey lookback window as CSV, straight from the immutable trail.
Every sign-in, denial, mutation, and export lands in an append-only, hash-chained audit trail with one-click chain verification — a broken link is mathematically visible. Events stream as structured JSON to your SIEM.
Every broadcast writes all agency notifications in one transaction with one identical timestamp — tier by tier if you ladder your panel. Any auditor can run the query that proves no vendor ever saw a shift early.
Mapped to SOC 2 trust criteria in SECURITY.md, with the enforcing code linked control by control. Highlights:
AES-256-GCM, tenant id bound into the AEAD so ciphertext can't be replayed across tenants; durable encrypted store; pluggable HashiCorp Vault Transit backend. TLS to the graph (bolt+s).
Every read and write is authorization-checked by graph reachability (ReBAC). API keys are stored hashed, carry scopes, expire, rotate, and revoke. Magic-link sign-in with single-use, hashed tokens — and no account-existence oracle on the login surface.
Auth denials, authorization decisions, mutations, and evidence exports are all chained. Verification is a first-class endpoint; auditors get read-only access that is itself audited.
Daily expiry-alert escalations, primary-source re-verification sweeps, sanctions screening with human adjudication, live health/readiness/metrics endpoints, rate limiting, and structured security events to your SIEM.
Integer-cent money computed from the graph path with explicit, documented rounding — never estimated. Input validation at every boundary. Feeds that go down change nothing: an outage can never silently alter a credential's standing.
Backup/DR and log-shipping runbooks ship with the code. The whole system builds from a clean clone and runs anywhere — container or bare host — with schema applied on boot.
Five rules, each with a test that is its oracle. Weakening a test to pass is forbidden — by the mission document itself.
Crane's SOC 2 gap list is public, in the same file as the finished controls. You can read exactly what's done, what's next, and which code enforces each claim — before you ever talk to us.