Aptible vs owning your HIPAA infrastructure
When to stay on a compliance-PaaS like Aptible, and when to run HIPAA and SOC 2 infrastructure in your own cloud account. An honest decision guide.
If you run a healthtech, fintech, or insurtech product, at some point you decide where your compliant infrastructure lives. One option is a compliance-PaaS like Aptible, Porter, or a Heroku-style platform with HIPAA and SOC 2 baked in. The other is your own cloud account, where you run the controls yourself.
Both are legitimate. The right answer depends on your stage, your team, and what your buyers are asking for. Here is how we think about it, including the cases where staying on Aptible is the better call.
The short version
A compliance-PaaS is the right call when you are early, your team is small, and no one owns infrastructure. You outgrow it when cost at scale, a data-residency requirement, or an enterprise security review pushes you to run HIPAA and SOC 2 controls in your own cloud account, or when your infrastructure grows past what the platform can hold.
What a compliance-PaaS actually gives you
Aptible is good at what it does, and it is worth being honest about that before talking about moving off it.
It runs your app in an environment that is already set up for HIPAA and SOC 2. It signs a BAA by default, carries its own HITRUST certification, and handles a long list of controls (encryption, network isolation, audit logging, access management) that you would otherwise have to build and maintain yourself. For a pre-seed or seed team with no platform engineer, that is real value. You get to an audit-ready posture in days instead of hiring for it.
If that describes you, a PaaS is usually the cheaper and faster choice once you count the cost of an engineer to build and run your own platform. Rebuilding that before you need to is work for its own sake.
Where teams outgrow it
The trigger to move is almost never “we do not like the platform.” It is one of these showing up.
Cost at scale. A per-app platform fee plus usage is predictable and cheap early. As you add services and traffic, the platform fee and usage markup grow on top of the cloud costs underneath. Past a certain size, running the same workloads in your own account at wholesale cloud pricing is meaningfully cheaper.
Data residency and BAA limits. If you need workloads pinned to a specific region, or a BAA and data-handling terms the platform cannot meet, you run into the edges of what a PaaS controls for you.
Enterprise security reviews. This is the sharpest one. A large customer’s security team often wants to inspect the controls themselves: your account, your logs, your network, your IAM. On a PaaS those controls run in the vendor’s environment, so you cannot hand the reviewer direct visibility into your own account. Sometimes “we use a compliant platform” clears the review. Sometimes it stalls the deal.
Infrastructure the platform does not cover. The moment you add a data lake, an ML pipeline, or a PHI pipeline that lives outside the app the PaaS runs, that infrastructure is yours to secure and prove. Now you are running compliant infra in your own account anyway, next to a PaaS that only covers part of the picture.
Lock-in. Your app is built to the platform’s shape. Moving off it later is a rebuild, and that rebuild gets more expensive the longer you wait.
What “owning it” looks like
Owning it does not mean going back to hand-configuring servers. In A-Dev’s white space it means HIPAA and SOC 2-grade infrastructure in your own cloud account (AWS, GCP, or Azure), with every control written as code rather than asserted in a policy document.
Concretely that is:
- Network isolation, least-privilege IAM, encryption at rest and in transit, and immutable audit logging, all defined in Terraform so they hold and can be shown to an auditor.
- Keyless CI/CD using OIDC federation, so there are no long-lived deploy secrets sitting in your pipeline for an attacker or an auditor to flag.
- A BAA signed directly between you and your cloud provider.
- The controls that live outside a standard app (data pipelines, ML, analytics) brought into the same posture instead of left uncovered.
This is narrow and deep on purpose. GRC-broad partners and policy tools like Vanta or Drata detect gaps and produce evidence, but they do not build the infrastructure that closes them. Owning it is the infrastructure half: the controls auditors actually test, made real in your stack.
It is the same setup A-Dev has built in production, for example a clinical platform for a cardiac medical-device company, HIPAA-grade, running on Azure with private Kubernetes, everything in Terraform and deployed through keyless CI/CD.
Compliance-PaaS vs owning your infra
| Compliance-PaaS (Aptible, Porter) | Owning it in your cloud | |
|---|---|---|
| Where it runs | The vendor's AWS environment | Your own cloud account (AWS, GCP, or Azure) |
| Who holds the BAA | The platform vendor | You, directly with your cloud provider |
| Time to audit-ready | Fast: days to a few weeks | Weeks with help, longer built from scratch |
| Cost shape | Per-app fee plus usage; predictable early, climbs with scale | Cloud at wholesale plus build cost; cheaper per unit as you grow |
| Enterprise security review | “We use a compliant platform,” which some reviewers accept and some push back on | Controls visible in your own account, your logs, your network |
| Infra outside a standard app | Sits outside the platform, not covered | In scope, same controls applied |
| Leaving | Rebuild required to move off | Portable Terraform, nothing to leave |
| Who defines the controls | Shared, vendor-defined | You, defined in your own code |
| Best fit | Early team, standard app, no infra owner | Scaling team, enterprise deals, own-cloud requirement |
How a migration off Aptible actually goes
Moving off a PaaS is not a lift-and-shift, because the platform was quietly holding controls you now have to run yourself. In practice it goes in three phases.
Assessment. Before anything moves, you map what Aptible is doing for you today: encryption, network isolation, audit logging, access controls, the BAA, backups. A lot of it you inherit and have never had to think about, which is exactly why an unplanned migration goes wrong. That inventory is the real starting point, and it is what a free Compliance Infra Gap Check produces: the top 3 to 5 things you would need to own in your own account, in about 30 minutes, no strings. If you are weighing the move, that is the cheapest way to see what it involves before committing to anything.
Parity. You stand up the same posture in your own account, in code. Since Aptible already runs on AWS, moving into your own AWS account is the most direct path and keeps you on the same cloud, though the same patterns apply just as well to GCP or Azure. The goal is not to recreate Aptible by hand, it is to have every control written in Terraform so it holds under load and stands up in an audit.
Cutover. With parity proven, you migrate data and traffic one service at a time, keeping Aptible running until the new environment is verified against the same control set. Then you decommission.
The first phase is cheap and low-risk, so that is where to start.
When staying on Aptible is the right call
To be clear, plenty of teams should not move. If you are pre-seed or seed, your team is small, no one is dedicated to infrastructure, and your application is fairly standard, a compliance-PaaS is usually cheaper and faster all-in. Aptible passing HITRUST and signing a BAA by default is real, and you should not trade it away before a concrete trigger shows up. Move when one does: a stalled enterprise deal, a cloud bill that has outgrown the platform, a data-residency requirement, or infrastructure that no longer fits inside the PaaS. Until then, the platform is doing its job.
Frequently asked questions
Should I move off Aptible?
Not on principle. Move when a specific trigger appears: an enterprise security review that wants controls in your own account, a cloud bill that has outgrown the platform fee, a data-residency requirement Aptible cannot meet, or infrastructure like a data lake or ML pipeline that lives outside the platform. If none of those apply and your team is small, staying is usually cheaper and faster.
Is Aptible HIPAA compliant enough for enterprise?
Aptible itself is HIPAA-capable, HITRUST certified, and signs a BAA, so the platform is not the problem. What some enterprise security teams push back on is that the controls run in the vendor’s environment rather than yours, so they cannot inspect your account, your logs, or your network directly. Whether that blocks a deal depends on the buyer. When it does, the fix is running the same controls in your own cloud account.
What does it cost to own HIPAA infrastructure?
There are two parts. Your cloud bill, which you pay at wholesale rates directly to AWS, GCP, or Azure, and the cost of building and maintaining the controls. At small scale, once you add an engineer’s time, a PaaS is often cheaper all-in. At scale the math flips, because platform fees and usage markups keep growing while a well-built own-cloud foundation mostly just runs. A-Dev’s fixed-price Audit-Ready Infra Sprint scopes the build for a flat $4,000 before you commit to any of it.
If I leave Aptible, do I lose my BAA and compliance?
No, but the responsibility moves to you. On a PaaS, the vendor holds part of the posture for you. In your own account, you sign the BAA directly with your cloud provider and you own the controls. Done properly, with the controls enforced in Terraform, your posture is actually stronger, because it is inspectable and version-controlled rather than inherited from a platform you cannot see into.
Can I run HIPAA infrastructure in my own AWS account?
Yes. Aptible already runs on AWS, so moving into your own AWS account is the most direct path and keeps you on the same cloud. The same control patterns also apply to GCP and Azure if you would rather run there. A-Dev runs HIPAA and SOC 2-grade platforms in production on GCP and Azure, and the same patterns (least-privilege IAM, keyless deploys, encryption, immutable logging, network isolation) port to AWS.
Start with a free Gap Check
If you are weighing this decision, start with the cheapest, lowest-risk part.
- Free Compliance Infra Gap Check. The top 3 to 5 gaps between where you are now and an audit-ready setup in your own cloud, in about 30 minutes, no strings attached.
- Audit-Ready Infra Sprint. A fixed-price ($4,000) infrastructure gap assessment and prioritized remediation roadmap in about three weeks. You pay only after you approve the work.
One senior engineer owns the build and answers for the audit. HIPAA and SOC 2-grade infrastructure in your own cloud account, enforced in Terraform and keyless CI/CD.
