diff --git a/CLAUDE.md b/CLAUDE.md
index 21cf39f..6aa0969 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -78,12 +78,77 @@ Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Project
 | Export CSV works and opens cleanly | NOT VERIFIED end to end |
 | Placeholder content removed | NOT VERIFIED |
 | Browser smoke test passes | NOT RUN |
-| Data handling rules documented | PASS |
-| Real PHI blocked | PASS |
+| Data handling rules documented | PARTIAL — hashing and RLS confirmed; retention sink priority, CSV disposition policy, minimum necessary fields, and payer_rules.json cadence not yet documented |
+| Real PHI blocked | PARTIAL — architecture confirmed; Supabase plan tier (Pro vs Team) not yet verified |
 | Pilot success metrics written down | PASS |
 
 Update this table every build session. Re-count PASS items before quoting a % to anyone.
 
+---
+
+## Compliance Readiness Checklist
+
+Source: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Projects/2026-06-04-signal-compliance-whitepaper.md`
+
+This checklist tracks compliance gates separately from build readiness. Update it alongside the pilot readiness table above.
+
+### Gate: Pilot (before any supplier sees the product)
+
+| Compliance Item | Status |
+|---|---|
+| HTTPS enforced across all surfaces | PASS |
+| CORS locked to Vercel domain (ALLOWED_ORIGINS env var) | PASS |
+| API key auth on upload and export endpoints | PASS |
+| Clerk JWT validation active | PASS |
+| Supabase RLS enabled | PASS |
+| PHI fields (name, DOB, SSN) blocked at normalizer | PASS |
+| patient_id as sole crosswalk key | PASS |
+| SHA-256 hashed identifiers in all audit log entries | PASS |
+| Service role keys absent from frontend env vars (VITE_) | PASS — verified 2026-06-05 |
+| Railway-to-Supabase TLS | PASS — Supabase SDK manages SSL at infrastructure level |
+| CSV file disposition post-normalization confirmed | PASS — raw bytes discarded; only hash + normalized records persist |
+| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | NOT DONE |
+| PostgreSQL as primary audit log retention sink documented (6-year) | NOT DONE |
+| MFA confirmed on all admin accounts (AWS, Supabase, Railway, Vercel, Clerk) | NOT VERIFIED |
+| payer_rules.json quarterly update cadence documented | NOT DONE |
+
+### Gate: First Supplier (before Robert Robinson or any pilot partner uploads data)
+
+| Compliance Item | Status |
+|---|---|
+| Privacy Policy published at stable public URL | NOT DONE |
+| FDA CDS exemption memo written and attorney-reviewed | NOT DONE |
+| Supabase plan tier confirmed (Pro vs Team) and PHI posture documented | NOT VERIFIED |
+| Pilot LOI reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
+| NDA template reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
+| Pilot LOI executed with supplier | NOT DONE |
+| NDA executed with supplier | NOT DONE |
+| Minimum necessary field documentation written (why each of 5 fields is required) | NOT DONE |
+| Incident response procedure written (includes breach notification timeline) | NOT DONE |
+| Data retention and deletion procedure written | NOT DONE |
+| Deletion procedure tested against Gaboro test batch | NOT DONE |
+| Internal tabletop incident exercise completed | NOT DONE |
+| Production access scope documented (who has access and why) | NOT DONE |
+| CMS AI governance quarterly monitoring cadence set (WISeR reminder) | NOT DONE |
+| labABLE kit-in-kit arrangement reviewed for Anti-Kickback Statute exposure | NOT DONE — required before any labABLE agreement is executed |
+
+### Gate: Real PHI (post-funding, before any direct patient identifiers enter the system)
+
+| Compliance Item | Status |
+|---|---|
+| AWS RDS encryption at rest confirmed when activated | NOT DONE |
+| Supabase upgraded to Team plan or replaced with AWS RDS | NOT DONE |
+| Railway replaced with BAA-capable host (AWS ECS Fargate or equivalent) | NOT DONE |
+| Full HIPAA Security Rule administrative safeguards review with attorney | NOT DONE |
+
+### Gate: Token Layer (before Med Tracker starts)
+
+| Compliance Item | Status |
+|---|---|
+| Token generation service built | NOT DONE |
+| Crosswalk handoff protocol defined for clinic onboarding | NOT DONE |
+| Signal updated to accept tokens instead of raw patient_ids | NOT DONE |
+
 ## What Is Tabled — Do Not Build Yet
 
 | Item | Phase | Reason |