# AI Coder Releases Source: https://docs.specode.ai/changelog/ai-coder-releases Release notes for Specode AI Coder updates ## 🎯 Highlights * Major HIPAA agent speed and reliability upgrade with parallel sub-agents * Deep security scanning: PHI leakage detection for payment providers, browser storage, audit logs, and more ## ✨ New Features * **HIPAA Agent: Parallel Scanning**: Scans now run with sub-agents for significantly faster results * **HIPAA Agent: PHI Leakage Detection**: New checks catch PHI leaking to payment providers (Stripe), session tokens stored in browser storage, clinical file links that never expire, and PHI in audit log fields or CSV exports * **HIPAA Agent: Endpoint Security**: Detects unprotected seed/reset/debug endpoints, unverified webhooks, and unprotected admin/cron routes * **HIPAA Agent: Build Health Context**: Scan results now show build and config health status as context banners ## 🔧 Improvements * **HIPAA Agent: 2026 Rule Calibration**: Pre-enforcement rules now treated as advisory suggestions rather than hard requirements * **HIPAA Agent: Smarter Access Scoping**: Distinguishes intentionally broad provider access from unscoped access to reduce false positives * **HIPAA Agent: Security Headers**: Advisory flags for missing security headers * **HIPAA Agent: Form Abuse Protection**: Flags public forms that create records or send email without rate limiting or CAPTCHA * **HIPAA Agent: Appointment Email Calibration**: Stopped flagging compliant appointment reminder emails (aligned with HHS guidance) * **HIPAA Agent: Server-Side Auditing**: PHI read auditing now required to happen server-side, not from the browser ## 🐛 Bug Fixes * Fixed HIPAA agent not clearing resolved issues from scan results * Fixed compliance score not improving after multiple fix-and-rescan cycles ## 🎯 Highlights * Faster, less verbose agent responses with better post-action guidance ## ✨ New Features * **Design Review Flow**: Design changes now require explicit approval before the dev agent implements them ## 🔧 Improvements * **Less Verbose Agents**: Reduced agent verbosity for cleaner, more focused responses * **Post-Design CTA**: After the design agent finishes, users now get a clear call-to-action to continue * **HIPAA Agent Fix Detection**: Scanner now properly picks up fixes applied in subsequent scans ## 🐛 Bug Fixes * Fixed 2-3 second delay between hitting enter and the message being sent * Fixed external git repo imports (from Lovable, etc.) being incorrectly accepted * Fixed agent falsely claiming "Changes uncommitted on main" * Fixed git push failing in workspaces due to invalid credentials * Fixed "error in project" message showing when no project exists yet * Fixed subagent work getting cut off and restarted, prolonging build slices * Fixed git HEAD reset destroying verified commits mid-session ## 🎯 Highlights * Comprehensive HIPAA scanning overhaul with 10+ new security check categories ## ✨ New Features * **HIPAA Agent: Expanded Coverage**: New scan categories including RBAC detection, audit log detection, data handling and display, file uploads and documents, data encryption (at rest and in transit), API security, infrastructure and environment, PHI exposure in UI/URLs, and third-party services and BAAs ## 🐛 Bug Fixes * Fixed AI responses appearing duplicated in chat * Fixed HIPAA compliance agent failing with module errors in production * Fixed AI coder leaking internal chain-of-thought into user-facing chat * Fixed false 524 deployment errors during Convex deploy * Fixed callback hook blocking implementation progress when server showed no pending reviews ## 🎯 Highlights * New CometChat component for in-app messaging ## ✨ New Features * **Maestro: Audit Log Implementation**: Maestro can now plan and implement audit logging for PHI/ePHI surfaces * **Maestro: CometChat Skill**: New integration skill for adding CometChat in-app messaging ## 🔧 Improvements * **HIPAA Agent UI**: Updated button styling to match primary CTAs across the app ## 🐛 Bug Fixes * Fixed account seeding not working properly - agent now shows all created accounts * Fixed planning questions not appearing, leaving the app stuck without asking initial questions * Fixed repetitive Vite build errors during development * Fixed roadmap not being shown by the agent after planning * Fixed questionnaire questions disappearing before users could answer, showing "Waiting on answers" prematurely ## 🎯 Highlights * New Maestro skill system: 8 healthcare-specific skills (Intake, Scheduling, Admin UX, Provider Profile, Provider Search, Organization Topology, MFA Implementation, Twilio SMS) ## ✨ New Features * **Maestro Skills**: Intake, Scheduling, Admin UX, Provider Profile, Provider Search, Organization Topology, MFA Implementation, and Twilio SMS skills * **HIPAA Agent MFA Scan**: New MFA compliance scanning capability ## 🔧 Improvements * **Maestro: First build slice + skills**: Improved how first build works with the skill system * **Maestro: Design agent image guidance**: Design agent now clearly calls out when users should upload images to steer design * **Maestro: No image upload folder instructions**: Stopped asking users to upload images to specific folders * **Maestro: Mobile apps scope guardrail**: Mobile apps flagged as out of scope in MVP, require custom plan * **Maestro: Skill hot-reload**: Kill instances so skills reload when updated to fix bugs * **Rate limit increase**: Increased rate limit with E2B ## 🐛 Bug Fixes * **Rate limit deploy error**: Fixed rate limit error when deploying - must be opened in a deployed preview, won't work in the inline preview * **CSS @import ordering**: Fixed ECONNREFUSED during design phase caused by CSS @import ordering * **HIPAA agent failures**: Fixed HIPAA agent run failing intermittently in production * **Duplicate planning messages**: Fixed Maestro showing duplicate planning message/duplicate questions * **"Message and product name required" error**: Fixed AI coder error message * **Stripe Integration Preview**: Fixed preview never loading for Stripe integrations * **Bizarre "request failed" error**: Fixed mysterious request failed error * **Table UI in chat**: Fixed weird table UI rendering in AI chat responses * **Roadmap/Design brief visibility**: Fixed roadmap and design brief sometimes not showing up ## 🎯 Highlights * Free trial credits increased to 80 (up from 50) * Improved preview reliability after builds ## ✨ New Features * **Clone Projects**: "Duplicate" renamed to "Clone" with a confirmation dialog to prevent accidental copies ## 🔧 Improvements * **More Free Trial Credits**: Free trial allowance increased from 50 to 80 credits, giving new users more room to explore * **Better Seed Account Display**: After seeding, the agent now shows all created accounts instead of just a single password * **Stripe Webhook Guidance**: Stripe integration now tells you exactly which events the webhook needs to listen for * **Smarter Image Sourcing**: The agent now correctly uses images from Unsplash/Pexels in designs ## 🐛 Bug Fixes * Fixed roadmap not appearing after planning completes successfully * Fixed preview not auto-loading after first build completes * Fixed error display overlapping mobile preview - errors now show above the preview window ## 🎯 Highlights * Smarter planning experience with improved question flow * Significant UI polish across chat, preview, and developer console * Better error handling so you spend less time guessing what went wrong ## ✨ New Features * **Mailgun Integration**: New one-shot integration skill for Mailgun email delivery * **Page Refresh Recovery**: If you refresh mid-build, Specode now shows an indicator that the agent is still working ## 🔧 Improvements * **Better Branding & Design**: Improved color picking and branding suggestions during the design phase, with guidance to upload images for best results * **Improved First Slice Scope**: First builds now include a more complete starting point beyond just a landing page * **Smarter Log Handling**: The agent checks logs directly instead of telling you to check them yourself * **Focused First Slice**: Integrations are no longer added prematurely in the first build slice * **Reduced Deferred Scope Hallucination**: The planner is more grounded in what it defers to later phases * **Readability on Blurred Preview**: Lighter overlay text color for better readability in both dark and light mode ## 🐛 Bug Fixes * Fixed long AI messages breaking the chat layout * Replaced text upload indicator with a clean circular progress indicator * Fixed chat not fully scrolling to the bottom when streaming messages * Fixed patient input getting cut off when the sidebar is narrow * Fixed dev console UI layout issues * Fixed card width in chat and repositioned the action menu * Fixed sandbox error briefly flashing before the blur overlay loads * Various UI refinements for preview panel and header * Fixed design agent response disappearing mid-conversation * Fixed spammy infinite-loop message sequences from the agent * Fixed planning questions not appearing after the planning agent completes * Fixed double streaming during agent handover * Fixed first slice confirmation message disappearing from chat after being written * Fixed agent re-asking for design approval after it was already given * Fixed preview showing blank white screen instead of auto-refreshing after first slice * Fixed Stripe integration showing contradicting API key data and missing webhook URL * Fixed auth seeding failures * Fixed Cloudflare error preventing the agent from starting when using tools ## 🎯 Highlights * Introducing Maestro: a new conversational workflow that takes you from a simple prompt to a working app in minutes * Redesigned planning, design, and build phases for a smoother experience ## ✨ New Features * **Conversational Planning Flow**: Describe your app idea in a simple prompt and Maestro generates a full PRD through a guided conversation * **Design Phase**: Review and approve a design brief before building begins * **First-Shot Build**: Get a working 3-5 screen app in \~10 minutes from your approved plan * **Conversational Iteration**: Refine your app through natural back-and-forth with the AI coder * **Multi-Image Upload**: Upload multiple reference images at once during planning * **Example Login Credentials**: Auth-enabled apps now come with seed logins so you can test different roles immediately * **HIPAA Compliance Responses**: The AI agent can now answer HIPAA compliance questions directly * **Legacy Project Support**: Existing projects work seamlessly with the new workflow ## 🔧 Improvements * Default 50/50 split between chat sidebar and app preview * App preview opens immediately - no more dashboard loading spinner * New preview controls: hide, launch in new tab, and refresh * Planning conversations are higher quality and more focused * Design agent creates a focused MVP scope ## 🐛 Bug Fixes * Fixed AI agent losing chat context between planning, design, and build steps * Fixed AI not responding in chat after initial build (work continued in background but chat appeared stuck) * Fixed code preview showing placeholder text during the planning phase * Fixed delay/no feedback when sending longer messages * Fixed strange sandbox messages about "agent process starting" appearing in chat * Fixed agent incorrectly asking users to run Convex commands for API keys * Added automatic retry for GitHub errors **HIPAA Compliance Agent** Specode now includes a built-in HIPAA Compliance Agent that scans your codebase for potential HIPAA violations — no setup required. **How it works:** * Run the agent on demand from the Compliance Center inside the AI Coder whenever you want to check your app's compliance * The agent uses a multi-agent system: two independent AI agents scan your code in parallel, then a third merges and verifies the results to reduce false positives * Issues are categorized by severity (Critical, High, Medium, Low) so you know what to fix first * Once flagged, you can copy the issue into the AI Coder chat and ask it to fix it for you * Re-run the agent after fixes and it will automatically mark resolved issues as complete **What it checks:** The agent currently covers a focused subset of HIPAA rules, including authentication and session security, data handling, and common compliance pitfalls. Additional categories will be added over time. **Good to know:** * Each full scan takes roughly 3-4 minutes and costs approximately 1 credit * The agent includes automatic retry if a scan fails mid-run * All scan history is saved so you can track your compliance progress over time ## 🎯 Highlights * Pen testing is now available as a purchasable service directly within Specode * Pro plan upgraded with 2,200 credits (nearly 3x), hands-on support, and expanded integrations ## ✨ New Features * **Pen Testing Purchase Flow**: Purchase an optional one-time pen testing service (\$3,000) directly through Specode. Includes a 90-day window for re-tests. * **AI Coder Observability**: Added monitoring and logging for AI coder sessions so we can diagnose and resolve errors faster when sessions reset or fail to respond. * **Expanded Pro Plan**: Pro now includes 2,200 credits, hands-on support with prompt guidance and unblocking sessions. ## 🔧 Improvements * **Design Quality Upgrade**: Added a design skill to the AI coder so generated apps produce cleaner, more polished UIs out of the box. * **Faster Subscription Activation**: Reduced wait time when activating or renewing a subscription. * **Deploy Errors Surfaced in UI**: Preview deployment errors are now shown directly in the app instead of requiring users to check the browser console. * **Forgot Password Works Out of the Box**: Password reset now uses default email credentials so it works immediately without needing to set up a third-party email service first. * **Submit Login with Enter Key**: Login form now submits when you press Enter. ## 🐛 Bug Fixes * Fixed an issue where new customers saw a loading screen after submitting payment with no confirmation (payment still processed in background). * Fixed linter errors not being surfaced before deployment, which caused users to hit errors only after attempting to deploy. This is an update with a label, description, and tag. ## 🎯 Highlights * Significantly faster project loading and setup times * Fixed critical authentication and connectivity issues ## ✨ New Features * **Dynamic Cross-Domain Authentication**: Signing into your deployed Specode app preview now works seamlessly across all environments, resolving redirect errors that previously occurred on Vercel previews ## 🔧 Improvements * **Faster Project Loading**: Projects now load noticeably faster thanks to parallel processing, optimized dependencies, and smarter caching - saving up to a minute in some cases * **Smoother Startup Experience**: Eliminated the blank white screen that appeared when opening a project * **Security Update**: Upgraded our underlying framework to address a critical security vulnerability ## 🐛 Bug Fixes * Fixed an issue where environment variables set in your project weren't being recognized * Fixed the HIPAA compliance banner incorrectly appearing in the AI coding workspace instead of only in app previews * Fixed the "Reload this page" popup that would interrupt you while the AI was working on your app * Fixed a "Refused to connect" error that occurred when logging out and back in on certain browsers ## 🎯 Highlights * Complete platform rebuild on serverless functions for backend for dramatically improved performance * More powerful Smart AI Agent * New pay-as-you-go credit system for flexible usage * Faster, semi-automated HIPAA-compliant deployment pipeline ## ✨ New Features * **New Tech Stack**: Migrated to serverless backend, replacing Supabase + Render infrastructure with approximately \$900 USD/month savings * **Advanced AI Model Addition**: AI Coder now powered by the most advanced AI models * **Pay-As-You-Go Credits**: Flexible credit purchasing system and smart consumption logic * **Dev Console**: New console providing real-time activity transparency and debugging capabilities * **Interactive Navigation Bar**: Redesigned navigation for faster project workflows * **Preview Modal Redesign**: Updated preview button and modal with HIPAA warning banner for compliance awareness * **Publish Flow**: New deployment flow - Submit your deployment to the support queue * **Logo & Favicon Upload**: Upload custom branding assets directly in the editor * **Video Tutorial Playlist**: YouTube playlist for onboarding * **Custom Plan Credits**: Enterprise support for custom monthly credit allocations ## 🔧 Improvements * **Massive Performance Update**: Significantly snappier UX, faster page generation, quicker code changes, and fully stable previews * **Web Container Stability**: Resolved disconnection and stability issues * **AI Response Formatting**: Improved thinking sequence display * **Blank Template**: Introduced a Blank Template at initial project creation * **Auth Template**: Blank template with authentication built in ## 🐛 Bug Fixes * **Dashboard 404 Error**: Fixed refresh (cmd+r) causing 404 on Vercel-hosted dashboard * **Port 5174 Error**: Resolved "Unable to connect to port 5174" after Vercel previews * **Video Player UI**: Fixed styling and call-to-action to match v1 * **Project Creation Spinner**: Added loading indicator to prevent "stuck" appearance * **Free Tier Error Message**: Updated messaging for users attempting to create more projects * **Legacy Modal (v1 Projects)**: Fixed display for existing users loading v1 projects * **Legacy Modal (First v2 Project)**: Fixed display for existing users creating first v2 project ## 🔄 Legacy Support * v1 project routing and support maintained for paid users backwards compatibility ## 🎯 Highlights * Interactive example prompts for improved onboarding experience * New admin section for platform management * Enhanced navigation with help button ## ✨ New Features * **Prompt Example Suggestions**: Interactive example prompt feature that cycles through real-world healthcare use cases. Users can click "See example" to explore different prompts that automatically type out the prompt. * **Admin Section**: New administrative interface for specode.ai platform management * **Help Button**: Added help button to top navigation for easier access to support resources ## 🔧 Improvements * **Prompt Text Area Styling**: Updated text color in prompt text area to use primary text color for better readability ## 🐛 Bug Fixes * **AI Coder Chat Truncation**: Fixed issue where AI Coder was cutting off prompt chats prematurely ## 🎯 Highlights * Initial production release of Specode AI Coder and Foundation platform * Comprehensive EMR modal components for allergies, conditions, and medications * Enhanced AI Coder chat interface with improved output formatting * Production-ready deployment ## ✨ New Features * **EMR Allergy Management**: Add/Edit modal component for patient allergies * **EMR Condition Management**: Add/Edit modal component for patient conditions * **EMR Medication Management**: Add/Edit modal component for patient medications ## 🔧 Improvements * **Chat Output Formatting**: Improved AI Coder response display with better structure and reduced delays between message segments * **Environment Setup**: Environments configured on Supabase ## 🐛 Bug Fixes * Fixed AI Coder project loading failures * Resolved connection interrupted errors * Fixed intermittent network errors that required page refresh * General UI consistency improvements and cleanup # Going Live Source: https://docs.specode.ai/overview/configuration-deployment/going-live Essential requirements for launching your Specode AI application. ## Ready to Publish? **Important:** The preview environment is not HIPAA-compliant. Do not use real patient data during testing or previews. Only test with synthetic or sample data. ### Ready to go live? Publishing requires a Pro plan (\$1,000/month) or higher. You'll need: * **HIPAA-ready production infrastructure** * **Signed BAAs with all services that handle PHI** * **Security review** **Backend hosting BAA is self-serve:** You sign Convex's BAA directly in your dashboard - no negotiation needed. We handle the migration to your production account with zero downtime. **Optional penetration test:** We offer an optional in-house penetration test for **\$3,000**. Teams typically request this when they need a pen test report for procurement, security review, or enterprise onboarding. If your app integrates with third-party services (telehealth video, messaging, eRx, analytics, etc.), those vendors may have their own fees and agreements, including BAAs where applicable. **Important:** Stripe does not sign a BAA and classifies certain healthcare categories (telemedicine, pharmacy) as restricted. The Specode team can help navigate Stripe approvals for restricted categories. See our [Payment Processing Guide](/overview/configuration-deployment/healthcare-payment-processing) for details. Press Publish in the top right corner. Before your app goes live, our team will review it to ensure everything is secure and HIPAA compliant. This typically takes 1-2 business days. We'll notify you by email once your app is deployed. Contact our team to begin your HIPAA-compliant deployment process. ## What You'll Need to Set Up Before your app can go live, there are a few accounts and configurations you'll need to handle on your end. Our team will guide you through each step. **Here's the sequence at a glance:** 1. *(Optional)* Run the HIPAA scan in Specode's HIPAA Compliance Center and fix any findings 2. Create a GitHub account and repository for your project, then invite `Specode-support` so our team can clone your code into your repo 3. Create a Convex Pro account and sign their self-serve BAA 4. Configure your Convex account to work with your custom domain 5. Set up HIPAA-grade accounts with all third-party service providers whose APIs touch PHI (e.g., Mailgun for transactional email) and sign BAAs with each of them 6. *(Optional)* Request an in-house penetration test from Specode Each step is detailed below. Before publishing, run the HIPAA compliance scan from the HIPAA Compliance Center inside your Specode project. The scan is on-demand and flags any issues that need to be resolved before going live. Fix everything the HIPAA compliance agent finds before proceeding. Create a GitHub account (if you don't have one), create a repository for your project, and invite `Specode-support` (`support@specode.ai`) as a collaborator. The Specode team will clone your project code into this repository. **Important:** Your GitHub repository receives an exact copy of whatever is in your Specode project at the time of cloning. The Specode team does not perform additional security checks after the code has been shipped to GitHub. All code hardening for HIPAA - including running the HIPAA scan and applying remediation fixes - must be completed while your project is still in the Specode development environment. Your app uses [Convex](https://www.convex.dev) as its backend database. During development, your project runs on Specode's shared Convex infrastructure. For production, you'll need your own Convex Pro account: 1. Sign up for a Convex Pro account at [convex.dev](https://www.convex.dev) 2. Sign the self-serve BAA directly in your Convex dashboard 3. Let the Specode team know once that's done - we'll migrate your project to your account We recommend completing this 1-2 weeks before your target launch date to avoid last-minute delays. If you're using a custom domain (e.g., `app.yourcompany.com`), you'll need to configure DNS records with your domain provider: * Point your domain to Convex (frontend) * Add DNS records for email service (e.g., Mailgun) For HIPAA compliance, you'll need signed BAAs with each service that handles protected health information (PHI). This includes: * **Convex** - self-serve BAA signed in your dashboard (covered in the Convex step above) * **Mailgun** (or your chosen email provider) - for transactional emails like password resets and notifications. Set up your account, get your API key, configure your sending domain, and sign their BAA. * **Any other third-party services** whose APIs touch PHI in your app (telehealth, messaging, eRx, analytics, etc.) Your Specode team will help identify which BAAs are needed based on your app's integrations. **What about BetterAuth?** Better Auth is an open-source authentication library that runs directly on your Convex backend. It is not a separate hosted service or third-party data processor - your authentication data is stored and processed entirely within your Convex environment. Since Convex is the data custodian (and you sign a BAA with Convex), no separate BAA is needed for Better Auth. **Important:** Stripe does not sign a BAA and classifies certain healthcare categories (telemedicine, pharmacy) as restricted. The Specode team can help navigate Stripe approvals for restricted categories. See our [Payment Processing Guide](/overview/configuration-deployment/healthcare-payment-processing) for details. ## After Publishing: Development Access Once your app is published through your own GitHub and Convex accounts, you still keep full access to your Specode project. As long as your subscription is active, you can continue using Specode as your development environment. However, new changes made in your Specode project will **not** automatically sync to the published app running on your own GitHub/Convex infrastructure. ### How updates reach your live app When you're ready to push changes to production, here's the workflow: 1. Make and test your changes in the Specode development environment 2. Run the HIPAA compliance scan on the updated code from the HIPAA Compliance Center 3. Contact the Specode team - we re-export the updated code to your GitHub repository 4. The updated code is deployed to your production Convex environment Your published app is always a HIPAA-compliant snapshot that has been hardened through the HIPAA scan, signed BAAs, and optional penetration testing. Each update goes through the same process to maintain compliance. Not sure where to start? Our team walks you through this entire process once you're ready to publish. Just click Publish or reach out to support. # Payment Processing Guide Source: https://docs.specode.ai/overview/configuration-deployment/healthcare-payment-processing How to choose the right payment processor for your healthcare app. ## Choosing the Right Payment Processor Not all payment processors work for all healthcare apps. Two independent factors determine which processor is right for your app: 1. **The processor's business category rules** - some processors restrict or prohibit certain healthcare business types (telehealth, pharmacy, prescription drugs) regardless of how you handle data. 2. **HIPAA and PHI requirements** - if protected health information (PHI) could appear in payment records, you need a processor that signs a Business Associate Agreement (BAA). Both factors must be satisfied. An app can pass the HIPAA test but still be blocked by a processor's category restrictions, or vice versa. ## When to Use Stripe Stripe is the easiest payment integration and works well for many healthcare apps. Use Stripe when **all** of the following are true: * It sells non-clinical wellness, fitness, education, general memberships, or content subscriptions * No diagnosis or treatment is delivered through the app * No prescription is written, sold, or delivered through the app * No PHI (diagnosis, treatment notes, CPT codes, visit reason, or clinical metadata) is sent to or stored in the payment record **Examples where Stripe works:** wellness coaching memberships, fitness tracking subscriptions, mental health education content, supplement stores (no health claims), general health content platforms. Bare payment processing is exempt from HIPAA's BAA requirements under [Section 1179](https://www.law.cornell.edu/uscode/text/42/1320d-8) of the Social Security Act. This means a qualifying app can use Stripe legally as long as no PHI enters the transaction record - use generic statement descriptors (e.g., "SMITH MEDICAL PA" not "SMITH ONCOLOGY") and keep clinical details out of metadata, invoice line items, and receipts. ## Stripe for Healthcare Apps (Restricted Categories) Stripe's [Restricted Businesses policy](https://stripe.com/legal/restricted-businesses) classifies telemedicine/telehealth services, online pharmacies (including SaaS platforms), prescription pharmaceuticals, and prescription medical devices as **restricted categories**. This means these business types require Stripe's approval before they can process payments - they are not automatically available. Stripe also does not sign a BAA. **Specode helps navigate Stripe's approval process.** Our team works directly with Stripe to help customers in restricted healthcare categories get approved on a case-by-case basis. If your app falls into a restricted category, talk to the Specode team before assuming you need a different processor - we may be able to get you approved for Stripe. **Consider a BAA-signing processor if ANY of these apply to your app:** 1. The app provides telemedicine or telehealth consultations involving diagnosis or treatment (synchronous or asynchronous) 2. A clinician prescribes medication through the app - even if the prescription is sent to an outside pharmacy 3. The app sells, dispenses, or facilitates prescription pharmaceuticals, or operates as an online pharmacy 4. The app sells prescription-only or regulated medical devices 5. Clinical PHI would appear in transaction descriptors, invoice line items, metadata, or receipts 6. The app offers insurance products with medical benefit packages These categories are restricted by Stripe but **not necessarily blocked** - the Specode team can help assess your specific situation and facilitate the approval process. Alternative processors remain a solid option if Stripe approval is not viable or if you need a processor that signs a BAA. ## Recommended Processors by Use Case ### For Clinical Billing (Non-Prescribing) These processors sign BAAs and work well for clinical practices that bill for services but don't prescribe or dispense medication through the app: | Processor | BAA | Recurring Billing | Notes | | -------------------------------------------------------- | --- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [Helcim](https://www.helcim.com/healthcare/) | ✅ | ✅ | Formal HIPAA program with annual audit. Good for general clinical practices. | | [Rectangle Health](https://www.rectanglehealth.com/) | ✅ | ✅ | Healthcare-specialized. Integrates with 50+ healthcare systems. | | [InstaMed](https://www.instamed.com/) (JPMorgan Chase) | ✅ | ✅ | Purpose-built for healthcare payments. Best for mid-to-large healthcare organizations. | | [Square](https://squareup.com/us/en/legal/general/hipaa) | ✅ | ✅ | Signs a BAA for permitted-category clinical billing. **Not for prescribing telehealth or Rx** - Square's terms restrict telemedicine and prohibit online pharmacy. | ### For Telehealth and Rx (High-Risk) These processors specialize in high-risk healthcare verticals including prescribing telehealth and pharmacy: | Processor | BAA | Telehealth | Rx/Pharmacy | Gateway | | -------------------------------------------------------------------- | --- | ---------- | ----------- | --------------------- | | [PaymentCloud](https://paymentcloudinc.com/industries/telemedicine/) | ✅ | ✅ | ✅ | Authorize.net, NMI | | [Corepay](https://corepay.net/) | ✅ | ✅ | ✅ | LegitScript-certified | | [Payment Nerds](https://paymentnerds.com/) | ✅ | ✅ | ✅ | Authorize.net, NMI | | [Seamless Chex](https://seamlesschex.com/telemedicine/) | ✅ | ✅ | ✅ | No volume caps | All of these support recurring billing and card-not-present transactions. ## Hybrid / Split-Processor Architecture Apps that combine clinical and non-clinical revenue can use both processors simultaneously: * **Stripe** handles non-clinical revenue (wellness memberships, general content, supplements) * **BAA-signing processor** handles clinical/Rx revenue (telehealth consults, prescriptions) **Common pattern for prescribing apps:** Bill the patient for the clinical service (e.g., telehealth consultation) through a BAA-signing processor, and have a partner pharmacy charge the patient directly for the medication. This keeps your payment account clean and avoids regulatory issues. The Specode AI coder can integrate multiple payment processors in the same app - just describe the split in your chat. ## PHI Segregation Rules Regardless of which processor you use, follow these rules to keep PHI out of payment records: * Use generic statement descriptors (e.g., "SMITH MEDICAL PA" not "SMITH ONCOLOGY") * Keep transaction metadata limited to name, amount, and non-clinical service description * Put diagnosis, treatment, or visit reason in transaction metadata * Include CPT codes in invoice line items * Add clinical details to email receipts or refund notes * Use condition-revealing statement descriptors ## LegitScript Certification If your app processes card-not-present payments for medication sales, Visa and Mastercard require [LegitScript certification](https://www.legitscript.com/). This applies to online pharmacies, prescription delivery services, and telehealth platforms that facilitate medication purchases. Several high-risk processors (Corepay, PaymentCloud) can help you through the LegitScript certification process. ## Integration in Specode The Specode AI coder can integrate any payment processor that provides an API. The process is the same regardless of processor: 1. Tell the AI which processor you want to integrate 2. Ask what credentials you need 3. Sign up with the processor and get your API keys 4. Add credentials to your project settings 5. Tell the AI to verify the integration See [Integrations](/overview/configuration-deployment/integrations) for the general setup workflow. # Integrations Source: https://docs.specode.ai/overview/configuration-deployment/integrations Your app comes with Convex already integrated. Convex handles all the back-end ops for your health app. You only need to configure any additional third-party services. ## How Integrations Work Adding an integration to your Specode app follows this workflow: Describe the integration in your chat. For example: * "Add Twilio SMS notifications when appointments are confirmed" * "Integrate Stripe to collect copay payments at checkout" * "Pull lab results from \[Lab API] and display them in the patient dashboard" Ask: "What API keys do I need to add in Project Settings for this integration to work?" The AI will tell you exactly which keys to get from the external service. Sign up or log into the external service (Twilio, Stripe, etc.) and copy the credentials the AI specified. Navigate to your **project settings** (click the project name in the top left corner), scroll to the bottom of the Integrations section, and add your key/value pairs. Return to the chat and tell the AI you added the credentials: "I added my Twilio keys. Here are the values: \[paste keys]. Can you verify the integration works?" The AI will execute or test the integration with your credentials. **The AI guides you through the process.** It knows what credentials each service requires and can verify the integration is working once you've added them. **This works for any service, not just the ones listed below.** Whether you need voice/speech (Deepgram, AssemblyAI), payments (Stripe, Square), messaging (Twilio, SendGrid), or any other third-party API - the Specode AI coder can walk you through the setup. Just describe what you want in the chat and it will tell you which credentials to get and where to add them. The pre-configured integrations below are listed for convenience, but they are not the only ones supported. ## Pre-configured Integrations Follow the steps below to add common integrations one-by-one. ## 1. CometChat Video Integration **What it's for**: Powers HIPAA-compliant video appointments between patients and healthcare providers. Contact CometChat to set up a HIPAA-compliant subscription for healthcare use. Or create a free account for testing purposes (no PHI!) at cometchat.com. Once approved, you'll receive your credentials from the CometChat dashboard (left-side menu > Application > Credentials): * `App ID` → e.g. `1670574c0951d3ac2` * `Region` → `us` (in lowercase) * `Auth Key` → e.g. `2cfa119703d62ed75774da4e33f9f96f85fdf96f` * `Rest API Key` → e.g. `393a5593ceb9b9a638524fedad6f54151fc2019c` Add the CometChat credentials to your Specode project settings. CometChat integration Press the "Add Field" button a few times and make sure you have 4 empty Key/Value field. Then fill them with CometChat credentials and press Save. Supabase database URL Ask AI what exactly you should insert in the corresponding key fields for each of the 4 ComatChat values that you copy from CometChat Credentials dashboard. **HIPAA Compliance Required**: Standard CometChat accounts are not HIPAA-compliant. You must specifically request and pay for HIPAA-compliant video calling services before going live with patient video consultations. ## 2. Telegra Integration (Optional) **What it's for**: Provides telehealth and remote monitoring capabilities for healthcare providers. Reach out to Telegra for healthcare platform access Once approved, you'll receive your credentials: * `Telegra URL` → `Telegra_URL` * `API Email` → `Telegra_API_EMAIL` * `API Password` → `Telegra_API_PASSWORD` Add all three Telegra credentials to your Specode project settings ## 3. Junction Health Integration (Optional) **What it's for**: Integrates wearable device data and laboratory results for comprehensive patient monitoring. Reach out to Junction Health for healthcare API access Once approved, you'll receive your credentials: * `API Key` → `JUNCTION_API_KEY` Add the Junction Health API key to your Specode project settings ## 5. Payment Processing **What it's for**: Processes payments for healthcare products, subscriptions, and services. **Stripe restricts certain healthcare categories.** Stripe is the easiest option for non-clinical apps, but its [Restricted Businesses policy](https://stripe.com/legal/restricted-businesses) classifies telemedicine/telehealth and prescription pharmaceuticals as restricted categories requiring approval. Stripe also does not sign a BAA. The Specode team can help navigate Stripe's approval process for restricted healthcare categories. See our [Payment Processing Guide](/overview/configuration-deployment/healthcare-payment-processing) for full details on choosing the right processor. ### Stripe Stripe is the default payment integration. It works out of the box for non-clinical apps (wellness, fitness, education, memberships). For apps in restricted healthcare categories (telehealth, prescribing, pharmacy), the Specode team can help facilitate Stripe approval - talk to us before switching processors. Go to [stripe.com](https://stripe.com) and create a business account In the Stripe Dashboard, switch to "Test Mode" for development Navigate to Developers → API Keys and copy: * `Publishable key` → `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` * `Secret key` → `STRIPE_SECRET_KEY` In Developers → Webhooks, add endpoint: `your-domain/api/webhooks/stripe` Copy the signing secret → `STRIPE_WEBHOOK_SECRET` Add all three Stripe credentials to your Specode project settings ### BAA-Signing Processors (For Telehealth, Rx, and Clinical Apps) If your app involves telemedicine, prescribing, pharmacy services, or any flow where PHI may appear in the payment record, use a BAA-signing processor such as [PaymentCloud](https://paymentcloudinc.com/industries/telemedicine/), [Helcim](https://www.helcim.com/healthcare/), or [Corepay](https://corepay.net/). These processors support recurring billing, card-not-present transactions, and sign BAAs. The Specode AI coder can integrate any payment processor that provides an API - just describe the integration in your chat and provide the credentials. See our [Payment Processing Guide](/overview/configuration-deployment/healthcare-payment-processing) for a full comparison of processors by use case. ## Adding Custom Services **Need to integrate with other services?** You can add custom environment variables for any additional APIs or services. Go to your project settings in the top left corner of your screen Scroll down to the bottom of the integrations section Click the "Add Field" button to create new environment variables Add your custom service credentials: * Variable name (e.g., `CUSTOM_API_KEY`) * Variable value (your actual API key or credential) **Some Custom Integration Examples:** * Electronic Health Record (EHR) systems * Laboratory information systems * Pharmacy networks * Insurance verification services * Custom healthcare APIs **Need Additional Help?** If you encounter issues during setup, refer to our [Troubleshooting Guide](/overview/configuration-deployment/troubleshooting) or contact your project team for assistance with HIPAA-compliant service configuration. # Migrating to Specode Source: https://docs.specode.ai/overview/configuration-deployment/migrating-to-specode How to migrate your existing healthcare app from Lovable, Bolt, or other non-HIPAA-compliant platforms to Specode. ## Why migrate? If you built a healthcare app on a platform like Lovable, Bolt, or another AI code generator, there's a good chance it isn't HIPAA-compliant. That means you can't safely handle protected health information (PHI) - patient records, appointment details, billing data, or anything that ties health info to a real person. Specode is built for healthcare from the ground up. Every component, every integration, and the entire hosting stack is designed to meet HIPAA requirements. Migrating to Specode means your app gets compliant infrastructure without starting over from scratch. ## How migration works We read your existing codebase, build a map of how your project works - the pages, the data models, the authentication, where information is stored - and use that to plan how it moves onto Specode. You keep the features and logic you've already built while gaining HIPAA-compliant infrastructure. Install our GitHub App so we can scan your repository. This is read-only - we can't change, delete, or push any code. Our system reads the code and builds a project map. We identify what can transfer directly, what needs adjustment for compliance, and flag anything that won't work in a HIPAA environment. We walk you through what we found - what gets repurposed as-is and what needs to change. You'll know exactly what's changing and why before any work begins. Your screens, data model, and business logic get repurposed on Specode's HIPAA-compliant stack using our pre-built healthcare components. You can continue iterating with our AI coder just like you would on any other platform - but now with compliant infrastructure underneath. ## Install the Specode GitHub App To get started, you'll need to give us read access to your repository. This takes about a minute. Open GitHub and install the Specode HIPAA scanning app on your repository. ### Step-by-step 1. **Click the link above.** It opens a GitHub page for **Specode HIPAA scanning** - that's the name of our scanning app. 2. **Choose where to install.** GitHub asks which account to install on. Pick the personal account or organization that owns the repository. 3. **Select "Only select repositories."** Then pick just the repositories you want us to scan. We recommend this over "All repositories" - there's no reason to give us more access than needed. 4. **Click Install.** That's it. Nothing is downloaded and nothing on your side changes. Let us know it's done so we can start the scan. You'll need to be signed in to GitHub. If the repository belongs to a company or team account, you may need to be an owner or admin. ### What we can and can't do The app is **read-only**. Here are the exact permissions GitHub grants it: * Read the code in the repositories you selected * See basic repository details like name and branches * Change, delete, or push any code * Open pull requests or issues * See any repository you didn't select * See your password or personal account settings **About the app name.** The app is called "Specode HIPAA scanning" because it was originally built for our healthcare compliance scanning. It's the same app we use to read a project during a migration - the name just hasn't caught up with everything it does. ## Removing access You can remove access at any time without asking us: 1. On GitHub, go to **Settings > Applications > Installed GitHub Apps** 2. Find **Specode HIPAA scanning** and click **Configure** 3. Change which repositories we can see, or uninstall the app entirely For an organization, look under the organization's settings instead of your personal ones. ## What platforms can I migrate from? We can migrate from any platform where your code is in a GitHub repository (or can be exported to one). Common platforms we've migrated from include: * **Lovable** - AI app builder, not HIPAA-compliant * **Bolt** - AI code generator, not HIPAA-compliant * **v0 / Vercel** - Frontend tools without healthcare compliance * **Custom React/Next.js projects** - On non-compliant hosting If your code isn't on GitHub yet, push it to a repository first (even a private one), then follow the steps above. ## Questions? Something not working, or the GitHub page asks for permissions that don't match what's described here? Don't continue - send us a screenshot at [support@specode.ai](mailto:support@specode.ai) and we'll check it out. # Sharing Your Preview Source: https://docs.specode.ai/overview/configuration-deployment/sharing-preview How to share your app with others for testing and feedback using the deployed preview link. ## Preview vs. Editor Preview Your Specode project has two different ways to view it: | View | URL | Purpose | | -------------------- | ------------------------------------ | ------------------------------------------------------------------------------- | | **Editor preview** | `app.specode.ai/v2/your-project/...` | Your personal workspace for building with the AI. Only works inside the editor. | | **Deployed preview** | `your-project.convex.site` | A shareable link anyone can open in their browser. | The editor preview (`app.specode.ai/v2/...`) does not support direct deep links. If you try to share an editor URL with someone, they will likely see a 404 error. Always share the deployed preview link instead. **No PHI in previews.** The deployed preview is **not** a HIPAA-compliant production environment. Do not enter any real patient data, and make sure anyone you share the link with knows not to enter real patient information either. Use only sample or synthetic data for testing and demos. When you're ready to go live with real data, see [Going Live](/overview/configuration-deployment/going-live). ## Deploying Your Preview After making changes to your app with the AI, you need to redeploy the preview for those changes to appear on the shareable link. Click the **Preview** button in the top-right corner above your editor preview pane. Click **Deploy new version** to push your latest changes to the shareable link. Copy the deployed preview URL (e.g., `https://your-project.convex.site`) and share it with your testers, clients, or team. **Important:** The deployed preview is a snapshot. It stays in whatever state it was when you last deployed. If you make more changes with the AI, you need to click **Deploy new version** again for those changes to show up on the shareable link. ## Controlling Access Want to restrict who can see your preview? You can ask the AI to build a login page or access control system directly in your app. For example: * **Simple password gate** - A single shared password for viewing the demo * **User accounts** - Create accounts for specific reviewers with their own credentials * **Role-based access** - Give different viewers different permission levels (e.g., read-only vs. admin) Once built, share the deployed preview link along with the credentials you set up. Your reviewers can log in directly from their browser without downloading anything. ## Tips **Test auth features on the deployed preview.** Authentication flows like login, signup, and forgot password may not work correctly in the editor preview. Always test these features using your deployed preview link (`your-project.convex.site`). * Always test your deployed preview link in a different browser or incognito window to see what your reviewers will see. * If your preview link shows old content, make sure you clicked **Deploy new version** after your latest changes. * Remind anyone you share the preview with: **do not enter real patient data.** The preview is for demonstration and feedback only. # Troubleshooting Source: https://docs.specode.ai/overview/configuration-deployment/troubleshooting Known issues without built-in fixes ## Known Issues **Issue:** Specode confirms changes but they don't appear **Workaround:** Always manually refresh the preview window after each change **Issue:** Build or runtime errors occur but aren't shown in the interface **Workaround:** Ask Specode to check for errors if something seems wrong **Issue:** Specode misinterprets unclear instructions **Workaround:** Be extremely specific - include exact component names, locations, and desired outcomes **Issue:** Server stops but the interface doesn't indicate it **Workaround:** If unresponsive, manually restart the server using the Start Project button **Issue:** Preview doesn't load or shows connection errors in certain browsers. Specode's preview uses web containers, which require a modern Chromium-based browser. **Supported browsers:** * Chrome * Edge * Brave * Arc * Opera **Unsupported browsers:** * DuckDuckGo * Tor Browser * Firefox - inconsistent experience * Safari 16.4+ - inconsistent experience **Recommended browser:** Chrome or any Chromium-based browser (Edge, Brave, Arc). If preview isn't loading, try switching to Chrome or another Chromium-based browser. **Issue:** Engineering or the AI has fixed an issue, but you still see the old error in your preview. **Workaround:** Clear your browser cache for Specode-related sites, or try opening the preview in a different browser (or incognito window). Cached assets from a previous broken state can persist even after the underlying issue is resolved. # Frequently Asked Questions Source: https://docs.specode.ai/overview/getting-started/FAQs Common questions about building healthcare applications with Specode ## General Questions If you don't see your question here, reach out to support and we'll point you to the right doc. Specode uniquely combines: * **Speed of no-code** with full code ownership * **Healthcare focus** with built-in HIPAA compliance * **AI-powered development** for rapid iteration * **Custom code flexibility** without vendor lock-in You get the best of both worlds: rapid development and complete control. You own 100% of the application code your project produces. You can export it at any time, modify it independently, and deploy it anywhere. The AI Coder itself is proprietary Specode technology and runs within the Specode platform. It is not something you install separately or connect your own API keys to. Your subscription gives you access to the AI Coder for continued development. The code it generates, however, is entirely yours. This is a supported path. You own 100% of the code, so the move is mostly logistics: * We hand over the GitHub repository with the full source code * The stack is standard (React, Tailwind, Shadcn, Convex) with no proprietary dependencies, so any development team can pick it up * Once you're self-hosting, there are no Specode platform fees Customers have done exactly this. [AlgoRX](https://www.specode.ai/portfolio/algorx) built and scaled their platform on Specode, then brought development in-house as the company grew. A fair question to ask of any platform you build on, and there are two answers. **Who's behind it.** Specode is built and operated by Topflight, a US-based healthcare software development company with more than a decade of building and maintaining clinical-grade applications, and an in-house engineering and compliance team. **What happens in the worst case.** Your app doesn't depend on our existence. You own the full source code on a standard stack, and you can export and self-host at any time. No lock-in means no stranded app. **Pro:** Consultation with a senior product manager, prompt guidance for new features, hands-on weekly team support, bug fixes & small implementations, unblocking sessions on demand **Custom:** Everything in Pro, plus dedicated team support and managed services Pro is **\$1,000/month** and includes: * **2,200 credits/month** * **Unlimited draft projects** * **1 published project** * **Production deployment** * **Hosting setup included** * **Custom domain support** * **Consultation with a senior product manager** * **Hands-on weekly team support** * **Prompt guidance for new features** * **Bug fixes & small implementations** * **Unblocking sessions on demand** **Compliance-ready production deployment** * **Backend hosting BAA is self-serve** for production deployments - you sign Convex's BAA directly in your dashboard, no negotiation needed. We handle the migration with zero downtime. * **Optional in-house penetration test:** **\$3,000** (available upon request). **What's not included** * Third-party services your app integrates with (telehealth video, messaging, eRx, analytics, etc.) may have their own fees and agreements, including BAAs where applicable. Custom starts at **\$5,000/month** and includes everything in Pro, plus: * **Managed services & coding** * **Dedicated team support** * **Custom AI agents** * **Advanced integrations** * **Unlimited published projects** * **Custom feature development** A complete hands-off solution with our team building and maintaining your app. If you've exported the code and aren't using Specode, there are no platform fees - you manage the code yourself. If you're on Pro or Custom, there's a monthly subscription (see [pricing](https://www.specode.ai/#pricing)) that gives you credits, multi-project support, and additional features. Yes - pay-as-you-go credits are available on all plans. Credits don't roll over into the next billing cycle. **Credit top-ups:** * **50 credits - \$20** * **300 credits - \$100** * **800 credits - \$260** No. **\$1,000 is the monthly Pro subscription**, and it includes **2,200 credits per month** plus production deployment, team support, and more. Yes. Pro and Custom are cancellable. If you cancel, **your production app goes offline**. Before cancelling, you can export your code if you plan to self-host elsewhere. 1. Click your **project name** (from an active project) or **profile icon** (from the main dashboard) 2. Select **Settings** 3. Click **Change Plan** 4. Choose your new plan and complete payment Your account, projects, and all your work transfer automatically - nothing is lost when you upgrade. ## Technical Questions **Yes, extensive integration capabilities:** * EHR/EMR systems (Epic, Cerner, etc.) * Laboratory information systems * Pharmacy networks * Insurance verification systems * Third-party APIs * Custom integrations via webhooks We provide robust APIs and documentation for seamless connectivity. **1. Tell the AI what integration you want** Example: "I want to add Twilio SMS notifications when appointments are booked." **2. Ask the AI what credentials you need** Example: "What API keys do I need to add in Project Settings for Twilio to work?" The AI will tell you exactly which keys to get (e.g., Account SID, Auth Token). **3. Get your API keys from the external service** Sign up or log into the service (Twilio, Stripe, etc.) and copy your credentials. **4. Add the keys to Project Settings** Go to **Project Settings → Integrations**, scroll to the bottom, and add your key/value pairs. **5. Tell the AI you added the keys** Example: "I added my Twilio credentials. Here are the values: \[paste keys]. Can you verify the integration works?" The AI will execute or test the integration with your credentials. HIPAA compliance is built into every layer: **Platform-Level Security:** * End-to-end encryption * Secure authentication infrastructure * Protected data storage (Convex) * Regular security updates **Features You Build:** * Role-based access controls * Audit logging * Custom data retention policies **Built-in HIPAA Compliance Agent:** Specode includes a HIPAA Compliance Agent that scans your codebase for potential HIPAA violations - no setup required. Run it on demand from the Compliance Center inside the AI Coder. The agent uses a multi-agent system (two independent scans merged and verified by a third) to reduce false positives, and categorizes issues by severity (Critical, High, Medium, Low). You can copy flagged issues into the AI Coder chat to fix them, then re-run the scan to confirm. Each scan takes roughly 3-4 minutes and costs approximately 1 credit. All scan history is saved so you can track compliance progress over time. The agent currently covers authentication and session security, data handling, and common compliance pitfalls, with additional categories coming over time. Our AI helps you implement these compliance features using healthcare best practices. The backend infrastructure (Convex) provides the secure foundation; you build the application-specific safeguards on top. Several layers of structure and review sit between a prompt and your production app: * **Staged builds with approval gates.** Maestro's three specialized agents (Planning, Design, Implementation) take you from roadmap to design system to working code, and you approve each stage before the next one starts. Code gets written against an approved plan. * **Healthcare-specific skills.** For common healthcare patterns (patient intake, scheduling, provider search, MFA, and more), the AI follows structured playbooks built on proven healthcare workflows. It asks the right clarifying questions and builds to healthcare UX best practices instead of improvising from scratch. * **HIPAA Compliance Agent.** Run on-demand scans of your codebase from the Compliance Center. Issues come back ranked by severity, and you can re-run the scan after fixes to confirm they're resolved. * **Pre-launch review.** Before your app goes live in production, our team reviews it for security and HIPAA compliance. * **Hands-on engineering on Custom.** If you're on the Custom plan, our engineers build alongside your team or take over development entirely, working directly with the code. And since you own the full source code on a standard stack, your own developers can audit it at any time. Code quality and AI accuracy are two different problems, and we treat them that way. The platform covers the engineering side (see the previous question). The accuracy of a domain-specific AI feature, like a matching or recommendation engine, depends on domain data and expert judgment, so that part is a collaboration: * **Your curated dataset.** You provide the reference data the feature is measured against. We give you instructions on format and structure at project start, and the data goes in early or mid-project, so the engine is built and tuned against it from the beginning. * **Testing during development.** Once the feature reaches a testable state, you get a preview link to evaluate real outputs long before deployment. * **Expert validation.** Your subject-matter expert acts as the checkpoint on output quality, and automated evaluation against your dataset can be scoped into the project. We build and instrument the engine. You bring the ground truth. The backend hosting BAA is self-serve, no negotiation needed: you sign Convex's BAA directly in your dashboard, and we migrate your project over with zero downtime. In most cases, no. The typical requirement is a BAA at the hosting layer for production deployments. If your setup requires a direct BAA with Specode, contact us to discuss options. No. After deployment, Specode does not store or access your patient data. Yes. We offer an **optional in-house penetration test for \$3,000**. Teams typically request this when they need a pen test report for procurement, security review, or enterprise onboarding. **Specode is not SOC2 certified** at this time. However, our backend infrastructure (Convex) maintains **SOC2 Type II attestations**, which means your production data is stored on infrastructure that has passed rigorous third-party security audits. For teams that require a SOC2 report for procurement or compliance review, we recommend noting Convex's attestation status alongside the other compliance measures we support (self-serve BAA available for Pro deployments, optional penetration testing, HIPAA-ready architecture). Contact us if you have specific compliance requirements to discuss. **Absolutely.** The code is yours to modify: * Full access to source code * Well-documented, clean code structure * Built with Next.js framework * No proprietary dependencies * Continue development with any team Modern, production-ready stack: * **React** - Front-end React framework * **Shadcn** - Component library * **Tailwind CSS** - Styling framework * **Convex** - Database and authentication Yes. You can build applications with multilingual user interfaces. You can adapt copy, labels, and flows for different languages so patients and providers can use the product in their preferred language. Yes, in most cases. You can integrate third-party voice/AI agent providers to enable things like voice-driven intake, phone-based follow-up, or automated check-ins. The exact setup depends on the capabilities and compliance posture of the provider you choose - Specode can connect to external services, but those services need to support the workflows you want. Specode's in-app preview runs on web containers, which require a **Chromium-based browser**: * **Supported:** Chrome, Edge, Brave, Arc, Opera * **Not supported:** DuckDuckGo browser, some older browsers * **Partial support:** Safari (may have issues with preview) If the preview isn't loading or shuts down unexpectedly, try switching to Chrome or Edge. If your app preview looks wrong after changes or a fix from our team, try clearing your browser cache: 1. **Hard refresh:** Press `Ctrl+Shift+R` (Windows/Linux) or `Cmd+Shift+R` (Mac) 2. **Clear cache:** Go to your browser settings and clear cached images and files 3. **Reload the project:** Close the tab and reopen your project from the dashboard Stale cached assets can sometimes show an older version of your app even after issues have been resolved. ## Platform Specode's guided workflow gets you to a **working prototype with 3-5 screens in about 10 minutes**. From there, timeline to production depends on complexity: * **Basic telehealth app:** 1-2 weeks * **Custom patient portal:** 2-4 weeks * **Full healthcare platform:** 4-8 weeks Compare to traditional development: 6-12 months minimum. Because most of what makes healthcare development slow is already built. A generalist agency quoting a clinical application budgets hours for compliance infrastructure, secure auth, audit logging, and the learning curve of healthcare-specific flows. On Specode that foundation comes out of the box, AI handles the scaffolding, and development hours go to what's unique about your product. Behind the platform sits more than a decade of healthcare-only delivery, with processes tuned to these builds. The estimate looks light because the foundation work is already done. Yes. After your initial build, just describe what you want to add and the AI handles it - whether it's a new module, additional user roles, or entirely new workflows. There's no limit on what you can add or when. The guided workflow (plan, design, build) gets you to a working app fast, but development doesn't stop there. Yes - at any point. You're not locked into a linear process. After your first build, you can: * Revisit planning to add features or change scope * Redesign layouts, colors, or the full look and feel * Jump straight to implementation changes Just describe what you want in plain language. The AI adapts to your request - you don't need to manually switch between planning, design, or coding modes. You can even ignore the original roadmap entirely and take your app in a new direction. Normal additions and refinements don't break existing functionality. If you ask for something that requires a structural change - like replacing a dashboard layout or switching authentication methods - the AI will handle the transition, but those kinds of changes naturally touch more of the app. Build incrementally and test as you go for the best results. Yes-available on the Custom plan (from \$5,000/month). We can handle product design, UX flows, and brand implementation on top of Specode's theming system. There's no native mobile app output today. The web app is fully responsive and works on phones and tablets. If you later need native apps, you can plan that separately while reusing the same backend/services. For the Custom plan (when our team proactively builds with you): * Billing: monthly, starting at \$5,000/month. * Collaboration: primarily async (email) plus weekly standups. * Workflow: scope goals → iterative builds in Specode → reviews & refinements → ready for go-live steps (security/BAAs). The AI chat offers two model options: * **Max** - Higher quality results, uses more credits per message * **Core** - Lighter on credits, still capable for most tasks You can switch between them anytime using the model selector in the chat UI. If you're running low on credits or working on simpler changes, Core is a good way to stretch your balance. For complex features or detailed implementation, Max gives the best results. A few tips to get more out of your credits: * **Use the Core model** for routine tasks (see model selector in chat). Save Max for complex features. * **Be specific in your prompts.** Vague requests lead to longer AI responses and more credit usage. Tell the AI exactly what you want changed and where. * **One task per message.** Bundling multiple requests in one prompt can cause the AI to produce lengthy responses. * **Don't repeat yourself.** If the AI already completed a task, avoid re-explaining it. Just reference what was done and move on. **Have more questions?** Contact our team or explore our [Quick Start Tutorial](/overview/getting-started/quick-start-tutorial) to see Specode in action. # HIPAA Compliance Agent Source: https://docs.specode.ai/overview/getting-started/hipaa-compliance-agent Scan your codebase for potential HIPAA violations with the built-in Compliance Agent ## Overview Specode includes a built-in HIPAA Compliance Agent that scans your codebase for potential HIPAA violations - no setup required. Run it on demand from the **Compliance Center** inside the AI Coder whenever you want to check your app's compliance. ## How It Works The agent uses a **multi-agent system** to maximize accuracy: 1. **Two independent AI agents** scan your code in parallel 2. **A third agent** merges and verifies the results to reduce false positives 3. Findings are split into **Must-Fix** (required for HIPAA compliance) and **Nice-to-Fix** (recommended hardening) 4. **Handled-for-you** controls (like encryption in transit and at rest) are shown as already covered 5. Areas that don't apply to your app are marked **Not Applicable** 6. Findings are organized into clear categories with plain-language descriptions of what was found and where Once issues are flagged, you can copy them into the AI Coder chat and ask it to fix them — or send them directly to **Maestro** for automated fixes. After applying fixes, re-run the agent and it will automatically mark resolved issues as complete. ### Audit Log Implementation Maestro can also plan and implement HIPAA audit logging for PHI/ePHI surfaces in your app. It inspects your repo, confirms PHI surfaces with you, walks through policy decisions (reviewer access, retention period, self-access rules), and wires inline audit logging into every approved read/write surface. ## What It Checks The agent scans across 11 categories: | Category | What It Checks | | --------------------------- | --------------------------------------------------------------------------- | | Role-Based Access Control | Proper role definitions, access restrictions, admin vs. user separation | | Audit Logging | Whether user actions are tracked for compliance trail | | Data Encryption | HTTPS enforcement, secure API communication, database-level encryption | | Data Handling & Display | How PHI is processed, displayed, and managed | | PHI Exposure in UI & URLs | Patient data leaking through URLs, query parameters, or visible UI elements | | File Uploads & Documents | Secure handling of uploaded files, document storage protections | | API Security | Endpoint authentication, authorization checks, IDOR prevention | | Notifications & Messaging | Secure handling of notifications and messaging channels | | Multi-Factor Authentication | MFA implementation and verification | | Logging & Error Handling | Log sanitization (no PHI in logs), error handling practices | | Third-Party Services | Detects external services, classifies BAA handling | ## Usage 1. Open your project in the AI Coder 2. Click the **shield icon** in the toolbar to open the **Compliance Center** The shield icon (highlighted) opens the Compliance Center 3. Click **Run Scan** 4. Review flagged issues by severity 5. Copy any issue into the AI Coder chat to get a fix 6. Re-run the scan to verify fixes ## Good to Know * Each full scan takes roughly **3-4 minutes** and costs approximately **1 credit** * The agent includes **automatic retry** if a scan fails mid-run * All scan history is saved so you can **track your compliance progress** over time The HIPAA Compliance Agent helps identify potential issues in your code, but it does not guarantee full HIPAA compliance on its own. Always consult with a compliance professional for your specific requirements. # Quick Start Tutorial Source: https://docs.specode.ai/overview/getting-started/quick-start-tutorial Learn how Specode's guided workflow takes you from a simple idea to a working healthcare app ## How Specode Builds Your App Specode uses three specialized AI agents that guide you through planning, design, and implementation. You approve each stage before moving to the next — no black-box builds. Start with a simple, plain-English description of what you want to build. You don't need a detailed spec — just describe the problem you're solving and who it's for. **Example:** ``` I want to build a mental health platform for young adults. Patients should be able to find therapists, complete intake, schedule video sessions, and track mood between sessions. ``` The **Planning Agent** takes it from here — it asks clarifying questions (like a good PM would), then produces a scoped roadmap with priorities, user flows, and a clear first build. You can also **upload reference images** during planning — screenshots of apps you like, mockups, or wireframes. The AI uses them to understand what you're going for. The Planning Agent presents a roadmap scoped to an MVP — typically 3-5 screens for the first build. Review it, suggest changes, and approve when you're happy. **You're in control:** Nothing moves forward until you approve. Ask questions, adjust scope, or change priorities before any code gets written. Once the roadmap is approved, the **Design Agent** shapes how your app looks and feels. It asks about your brand preferences — colors, mood, apps you admire — and produces a design system. If you uploaded reference images earlier, the Design Agent pulls direction from them: color palettes, typography, layout density, and more. Review the design brief and approve it before building begins. The **Implementation Agent** writes your app based on the approved roadmap and design. A working build with 3-5 screens is typically ready in **about 10 minutes**. Your app comes with: * Working authentication with **example login credentials** for each role — so you can immediately test as a patient, provider, or admin * HIPAA-ready infrastructure under the hood * A live preview you can interact with right away From here, refine your app through natural conversation. Describe what you want to change and the AI handles it. **You're not locked into a linear process.** After your first build, you have full flexibility: * **Add new features** - describe what you want and the AI scopes, plans, and builds it * **Change the design** - from small tweaks (colors, spacing) to full layout redesigns * **Revisit planning** - add user roles, change workflows, expand scope at any time * **Go off-script** - you don't have to follow the original roadmap. Say "I don't like this direction, do this instead" and the AI adapts There are no hard guardrails on when or how you make changes. The guided workflow (plan, design, build) gets you to a working MVP fast, but after that, you're in the driver's seat. The AI figures out what kind of work your request needs - you just describe what you want in plain language. **Example refinements:** ``` In the patient dashboard, show appointments in a 3-column card layout instead of a list. Add a "Previous Appointments" section below. ``` ``` Update the color scheme: - Primary: #007AFF - Secondary: #5856D6 Keep the existing neutral grays. ``` ``` Add our branding: - Logo: [upload file] - Clinic name: "Mindful Health" - Update email templates with our logo and colors ``` ``` Actually, I want to add a pharmacy module. Patients should be able to request prescription refills and see medication history. ``` **Pro Tip:** Save major visual changes (branding, color overhauls) for after the core functionality is working. It's easier to iterate on features without worrying about maintaining custom styling. ## Building Advanced Features Once your foundation is in place, you can layer on more complex functionality through conversation: Describe what you want at a high level. Let the AI ask clarifying questions. **Example:** ``` I want automated follow-up reminders when providers send messages to patients. If a patient doesn't read a message within 2 hours, send them a reminder. ``` Add specifics as the AI builds. You don't need everything upfront — work iteratively. **Example:** ``` Add reminder preferences to patient settings: - Toggle reminders on/off - Adjustable delay (30 min to 24 hours, default 2 hours) - Quiet hours setting ``` For features that need external services, tell the AI what you want and it will guide you through setup. **Example:** ``` I want to use CometChat for the reminder messages. What API keys do I need to add in Project Settings? ``` The AI tells you exactly which credentials to get. Add them to **Project Settings → Integrations**, then confirm and the AI handles the rest. See our [Integration Setup Guide](/overview/configuration-deployment/integrations) for step-by-step instructions on adding credentials. Once the basics work, refine the behavior. **Example:** ``` Add smart reminder logic: - Cancel reminder if patient reads message before timer expires - Don't send reminders for automated system messages - Maximum one reminder per message - Group reminders if multiple unread from same provider ``` **Important:** Complex features rarely work perfectly on the first try. Build incrementally, test each step, and refine based on what you observe. # Theming & Design Changes Source: https://docs.specode.ai/overview/getting-started/theming-design-changes Customize your app's visual identity and branding with Specode AI ## Logo and Branding Assets Upload your logo and favicon as separate files directly in Specode, simply drag and drop or click to upload: * **Logo**: Upload your main logo file (PNG, JPG, or SVG) * **Favicon**: Upload your browser tab icon separately Upload files first, then reference them in your prompts. For example, after uploading, say: "Apply the logo I just uploaded to the header and login page" ## Understanding Shadcn Theming Specode uses Shadcn UI, which provides a powerful CSS variable-based theming system. The easiest way to transform your app's look is by customizing these key elements: ### Essential Customizations Changes buttons, links, selected states, and active elements throughout the app Adjusts all text from headings to body content for better readability Modifies all interactive buttons including size, radius, and hover effects Updates page backgrounds, card backgrounds, and surface colors **How it works:** Shadcn uses CSS variables like `--primary`, `--background`, and `--foreground`. When you change these, the entire app updates automatically. Learn more at [Shadcn Theming Docs](https://ui.shadcn.com/docs/theming). ## Practical Styling Examples Here are specific prompts for customizing different parts of your application: ```text Forms theme={null} Style all forms with rounded corners (radius-md), add focus rings in our brand color #0066CC, and increase input height to 48px for better touch targets ``` ```text Cards theme={null} Update all cards to have subtle shadows (shadow-sm), 8px border radius, and light gray borders (#E5E7EB) ``` ```text Navigation theme={null} Change the sidebar background to dark blue (#1E3A8A), make navigation text white, and highlight active items with a lighter blue background ``` ```text Buttons theme={null} Make all primary buttons use our brand color #0066CC, add 12px padding, rounded-lg corners, and a darker shade on hover (#0052A3) ``` ```text Tables theme={null} Style data tables with alternating row colors, sticky headers, and our brand color for sorting indicators ``` ```text Modals theme={null} Update all modals with 16px border radius, semi-transparent backdrop, and slide-up animation ``` ```text Alerts theme={null} Style success alerts with green (#10B981), errors with red (#EF4444), and add icons to each alert type ``` ```text Typography theme={null} Set all headings to use Inter font, body text to use system fonts, and increase base font size to 16px ``` ## Best Practices * Upload logo and favicon early * Apply branding incrementally * Test on different screen sizes * Ensure text readability * Consider accessibility * Use too many colors * Make text too small * Ignore mobile users * Forget dark mode option * Sacrifice usability for style **Ready to customize?** Start with "Upload logo and set primary color to \[your brand color]" or explore [Adding Features vs. Modifying](/overview/getting-started/adding-features-vs-modifying) for functional changes. # What Is Specode? Source: https://docs.specode.ai/overview/getting-started/what-is-specode Build Health Apps Faster. ## How It Works Describe your app idea in plain English and Specode's AI builds it for you. Three specialized agents guide you through planning, design, and implementation — with your approval at every stage. ### AI-Powered Development Specode uses a guided workflow: a **Planning Agent** scopes your MVP, a **Design Agent** shapes the look and feel, and an **Implementation Agent** writes the code. You review and approve each stage before moving forward. A working app with 3-5 screens is typically ready in about 10 minutes, then you iterate through conversation to refine and extend. This isn't a one-way funnel. After your first build, you can go back to planning to add features, revisit the design, or jump straight into implementation changes - at any point. The AI adapts to what you're asking for, so you don't need to think about which "mode" you're in. ### Build It Your Way You're not customizing pre-built templates — you're defining the app itself. You control: * **UI/UX**: Layouts, styling, navigation, and content * **Workflows**: Business rules, approvals, alerts, and automations * **Data Model**: Entities, fields, relationships, permissions * **Integrations**: Connect external services and internal systems as needed Specode v2 is designed for flexibility: you start from a blank template and build exactly what you need-no "work around the framework" moments. ## Who is it for? Launch healthcare apps on lean budgets with HIPAA rails Develop custom health and wellness apps without large teams Tackle healthcare projects with built-in HIPAA compliance Enhance provider and patient experiences with proven solutions Improve operational and engineering efficiency at scale ## What can we build? The possibilities are endless. Here are just a few examples of what you can create with Specode: Virtual care platform with AI-powered document processing and EMR workflows for seamless video consultations. Digital wellness companion with mood tracking, AI coaching, and community support features. Complete medication tracking system with reminders, drug information, and provider communication. Healthcare marketplace connecting patients with providers based on specialty, insurance, and availability. Specode's flexible foundation lets you build and iterate on any healthcare application you envision-from chronic care management to clinical trials, fitness tracking to hospital operations. ## Your Development Journey Tell Specode what you want to build in plain English. The Planning Agent asks the right questions and scopes your MVP — no spec required. Approve the roadmap and design before any code is written. Upload reference images to guide the look and feel. The Implementation Agent builds your first version in about 10 minutes. Test it immediately with built-in example logins for each user role. Refine through conversation, add features, apply branding. When ready, the Specode team assists with production deployment. **Ready to get started?** Continue to our [Quick Start Tutorial](/overview/getting-started/quick-start-tutorial) for a hands-on walkthrough of building your first feature. # Writing Effective Prompts Source: https://docs.specode.ai/overview/getting-started/writing-effective-prompts How to communicate effectively with Specode's AI agents to get the best results. ## How Prompting Works in Specode Specode's guided workflow handles the heavy lifting for you. When you start a new project, you describe your idea in plain language and the **Planning Agent** asks clarifying questions to scope your app. You don't need a detailed spec upfront — the AI guides you through the details. Where prompting skills matter most is during **iteration** — after your first build is ready and you're refining features, fixing layouts, or adding new functionality. **Starting a new project?** Just describe your idea simply and let the Planning Agent guide you. Save the detailed prompts for when you're iterating on a working app. ## Understanding Specode Think of the Specode AI as a highly skilled developer who: Understands healthcare workflows like EMR, scheduling, and intake Understands healthcare regulations and best practices Can build features based on your descriptions Can use uploaded screenshots and mockups to understand what you want ## Core Principles for Effective Prompts ### Be Specific, Not Vague ```text ✅ Effective theme={null} I need to add a preferred pharmacy field to the intake form. It should include pharmacy name, address, and phone number so providers know where to send prescriptions. ``` ```text ❌ Too Vague theme={null} Add a preferred pharmacy field. ``` ### Describe User Journeys, Not Technical Implementation ```text ✅ Effective theme={null} When patients cancel an appointment, they should select a reason from a dropdown. If they choose "other", show a text box for details. Then send this information as a notification to the provider. ``` ````text ❌ Too Technical theme={null} Render a dropdown list of predefined reasons. If the user selects 'Other', conditionally display a text input field for free-form entry. Capture the selected reason (and text input if applicable), then include this data in the cancellation event payload and dispatch it as a notification to the assigned provider.``` ```` ### Build Incrementally, Not All at Once ```text ✅ Effective theme={null} I want to implement a "View Availability" button that patients can view. First create the button, located right above the "Book" button on the provider card. It will be non-functional for now. ``` ```text ❌ Too Ambitious theme={null} Create a "View Availability" feature that allows patients to view provider availability. ``` **Follow Up Prompts** ``` Now let's make the button functional. When the user click's on "View Availability", open a new modal. ``` **Follow Up Prompts** ``` In this new modal, add the calendar ui component. Above it, include the title text "Select a date". ``` Then continue to iterate incrementally until you achieve your desired functionality. ### Include Context and Requirements Always specify: Who will use this feature (patients, doctors, staff, administrators) Specific fields or data that need to be collected or displayed Any specific healthcare compliance requirements beyond basics How this feature connects with other parts of your system ## Effective Request Patterns ### Creating New Features **Template:** ```text theme={null} I need a [feature type] that allows [user type] to [action]. It should [specific requirements] and [integration needs]. ``` **Example:** ```text theme={null} I need a no-show fee waiver request form that allows patients to explain why they missed their appointment. It should include: - A dropdown with common reasons (emergency, transportation issues, illness, work conflict, other) - A required text field for detailed explanation (minimum 50 characters) - The patient's contact information pre-filled from their profile - A checkbox to acknowledge the fee policy - Submit button that routes the request to the patient's primary provider for approval - The provider should receive an in-app notification with approve/deny options ``` ### Modifying Existing Features **Template:** ```text theme={null} Can you modify the [existing feature] to [new behavior]? Currently it [current behavior], but I need it to [desired behavior]. ``` **Example:** ```text theme={null} Can you modify the patient intake form to include a visual allergy severity scale? Currently it just has a text field for allergies, but I need it to: - Display a 1-5 severity scale with visual indicators (1=mild to 5=severe/life-threatening) - Use color coding: green (1-2), yellow (3), orange (4), red (5) - Include icons for common allergens (medications, foods, environmental, latex) - Allow multiple allergies with different severity levels - Show a warning banner if any allergy is marked as severe (4-5) - Make the allergy section required if the patient indicates they have allergies ``` ### Fixing Issues **Template:** ```text theme={null} The [feature] is [problem description]. When [steps to reproduce], it [what happens]. It should [expected behavior]. ``` **Example:** ```text theme={null} The provider notes are not saving properly. When I type notes during a video call and click save, the notes disappear. It should save them to the patient's record and show a confirmation. ``` ### Adding API Integrations Adding an integration is a conversation with the AI. Here's the typical flow: **Step 1: Request the integration** ```text theme={null} I want to integrate Twilio to send SMS appointment reminders. When an appointment is booked, send a confirmation text to the patient's phone number. ``` **Step 2: Ask what credentials you need** ```text theme={null} What API keys do I need to add in Project Settings for Twilio to work? ``` The AI will tell you exactly which keys to get (e.g., Account SID, Auth Token, Phone Number). **Step 3: Add credentials and confirm** After you get your keys from the external service and add them to Project Settings: ```text theme={null} I added my Twilio credentials to Project Settings. Here are the values: - TWILIO_ACCOUNT_SID: AC1234... - TWILIO_AUTH_TOKEN: abc123... - TWILIO_PHONE_NUMBER: +1555... Can you verify the integration works? ``` The AI will execute or test the integration with your credentials. See our [Integration Setup Guide](/overview/configuration-deployment/integrations) for step-by-step instructions on adding credentials to Project Settings. ## What Specode Handles Automatically You don't need to specify: Databases, APIs, server configuration Encryption, secure connections, authentication Basic HIPAA requirements and healthcare standards Mobile optimization and cross-device compatibility **Ready to start building?** Try your first prompt with Specode, or continue to [Theming & Design Changes](/overview/getting-started/theming-design-changes) to learn about visual customization.