Skip to main content

​
Ready to Publish?

Important: The preview environment is not HIPAA-compliant. Do not use real patient data during testing or previews. Only test with synthetic or sample data.

​
Ready to go live?

Publishing requires a Startup plan ($500/month) or higher. You’ll need:
  • HIPAA-ready production infrastructure
  • Signed BAAs with all services that handle PHI
  • Security review
Backend hosting BAA is self-serve: You sign Convex’s BAA directly in your dashboard - no negotiation needed. We handle the migration to your production account with zero downtime.
If your app integrates with third-party services (telehealth video, messaging, eRx, analytics, etc.), those vendors may have their own fees and agreements, including BAAs where applicable. Important: Stripe does not sign a BAA and classifies certain healthcare categories (telemedicine, pharmacy) as restricted. The Specode team can help navigate Stripe approvals for restricted categories. See our Payment Processing Guide for details.
Press Publish in the top right corner. Before your app goes live, our team will review it to ensure everything is secure and HIPAA compliant. This typically takes 1-2 business days. We’ll notify you by email once your app is deployed.
The Startup plan includes 1 published project, 3 draft projects, and 800 credits/month. Need more? Upgrade to Pro or Custom.

​
Ready to go live?

Publishing requires a Pro plan ($1,000/month) or higher. You’ll need:
  • HIPAA-ready production infrastructure
  • Signed BAAs with all services that handle PHI
  • Security review
Backend hosting BAA is self-serve: You sign Convex’s BAA directly in your dashboard - no negotiation needed. We handle the migration to your production account with zero downtime.
Optional penetration test: We offer an optional in-house penetration test for $3,000. Teams typically request this when they need a pen test report for procurement, security review, or enterprise onboarding.
If your app integrates with third-party services (telehealth video, messaging, eRx, analytics, etc.), those vendors may have their own fees and agreements, including BAAs where applicable. Important: Stripe does not sign a BAA and classifies certain healthcare categories (telemedicine, pharmacy) as restricted. The Specode team can help navigate Stripe approvals for restricted categories. See our Payment Processing Guide for details.
Press Publish in the top right corner. Before your app goes live, our team will review it to ensure everything is secure and HIPAA compliant. This typically takes 1-2 business days. We’ll notify you by email once your app is deployed.
Contact our team to begin your HIPAA-compliant deployment process.

​
What You’ll Need to Set Up

Before your app can go live, there are a few accounts and configurations you’ll need to handle on your end. Our team will guide you through each step. Here’s the sequence at a glance:
  1. (Optional) Run the HIPAA scan in Specode’s HIPAA Compliance Center and fix any findings
  2. Create a GitHub account and repository for your project, then invite Specode-support so our team can clone your code into your repo
  3. Create a Convex Pro account and sign their self-serve BAA
  4. Configure your Convex account to work with your custom domain
  5. Set up HIPAA-grade accounts with all third-party service providers whose APIs touch PHI (e.g., Mailgun for transactional email) and sign BAAs with each of them
  6. (Optional) Request an in-house penetration test from Specode
Each step is detailed below.
1

HIPAA Scan (Optional)

Before publishing, run the HIPAA compliance scan from the HIPAA Compliance Center inside your Specode project. The scan is on-demand and flags any issues that need to be resolved before going live. Fix everything the HIPAA compliance agent finds before proceeding.
2

GitHub

Create a GitHub account (if you don’t have one), create a repository for your project, and invite Specode-support (support@specode.ai) as a collaborator. The Specode team will clone your project code into this repository.
Important: Your GitHub repository receives an exact copy of whatever is in your Specode project at the time of cloning. The Specode team does not perform additional security checks after the code has been shipped to GitHub. All code hardening for HIPAA - including running the HIPAA scan and applying remediation fixes - must be completed while your project is still in the Specode development environment.
3

Convex (Database)

Your app uses Convex as its backend database. During development, your project runs on Specode’s shared Convex infrastructure. For production, you’ll need your own Convex Pro account:
  1. Sign up for a Convex Pro account at convex.dev
  2. Sign the self-serve BAA directly in your Convex dashboard
  3. Let the Specode team know once that’s done - we’ll migrate your project to your account
We recommend completing this 1-2 weeks before your target launch date to avoid last-minute delays.
4

Custom Domain

If you’re using a custom domain (e.g., app.yourcompany.com), you’ll need to configure DNS records with your domain provider:
  • Point your domain to Convex (frontend)
  • Add DNS records for email service (e.g., Mailgun)
5

BAAs and Third-Party Service Accounts

For HIPAA compliance, you’ll need signed BAAs with each service that handles protected health information (PHI). This includes:
  • Convex - self-serve BAA signed in your dashboard (covered in the Convex step above)
  • Mailgun (or your chosen email provider) - for transactional emails like password resets and notifications. Set up your account, get your API key, configure your sending domain, and sign their BAA.
  • Any other third-party services whose APIs touch PHI in your app (telehealth, messaging, eRx, analytics, etc.)
Your Specode team will help identify which BAAs are needed based on your app’s integrations.
What about BetterAuth? Better Auth is an open-source authentication library that runs directly on your Convex backend. It is not a separate hosted service or third-party data processor - your authentication data is stored and processed entirely within your Convex environment. Since Convex is the data custodian (and you sign a BAA with Convex), no separate BAA is needed for Better Auth.
Important: Stripe does not sign a BAA and classifies certain healthcare categories (telemedicine, pharmacy) as restricted. The Specode team can help navigate Stripe approvals for restricted categories. See our Payment Processing Guide for details.

​
After Publishing: Development Access

Once your app is published through your own GitHub and Convex accounts, you still keep full access to your Specode project. As long as your subscription is active, you can continue using Specode as your development environment. However, new changes made in your Specode project will not automatically sync to the published app running on your own GitHub/Convex infrastructure.

​
How updates reach your live app

When you’re ready to push changes to production, here’s the workflow:
  1. Make and test your changes in the Specode development environment
  2. Run the HIPAA compliance scan on the updated code from the HIPAA Compliance Center
  3. Contact the Specode team - we re-export the updated code to your GitHub repository
  4. The updated code is deployed to your production Convex environment
Your published app is always a HIPAA-compliant snapshot that has been hardened through the HIPAA scan, signed BAAs, and optional penetration testing. Each update goes through the same process to maintain compliance.
Not sure where to start? Our team walks you through this entire process once you’re ready to publish. Just click Publish or reach out to support.