Trust and security posture
What we hold, where it lives, who we share it with, and what your reviewers receive.
This page is for the person who has to sign off on the integration rather than write it. It states posture. It does not grade our own safety, and you will not find an accuracy percentage anywhere on this site.
Certifications and agreements
- SOC 2 Type II, across all five trust services criteria.
- HIPAA. We sign Business Associate Agreements. If you are a covered entity or a business associate, you need one with us before production data flows.
- Model providers are under BAA with zero data retention. The models that see patient-facing content do not retain it, and the agreement covering that is ours, not something you have to negotiate separately.
Where data lives
Environments are separate, and the separation is enforced rather than conventional. Sandbox and production are distinct environments with their own keys. A sandbox key cannot write into production. Sandbox is for synthetic and test data; real patient data belongs in production.
Your data is yours. Algorithms, protocols and care models belong to the people who built them. Running a model inside our environment does not give us rights to it, and it does not move a copy of patient data into yours.
What your reviewers receive
The record is the part most security reviews actually care about, because it is what turns a claim into evidence:
- Every patient-facing message is evaluated before it is sent. The decision is recorded whether the message went out or not.
- A withheld message is recorded too. What was proposed, what the gate decided, the policy and version that decided it, and whether a person released it.
- Holds route to a person. Anything the gate will not clear waits for someone on your team, with the reason attached.
- Decisions cite a version. Each one names the program document version that made it, so a reviewer can reconstruct what the rules were at the time rather than what they are now.
For how that record is produced, see the gate and its concepts. For a two-week observation before anything is enforced, see the observe engagement.
Reaching us
Security questions, BAAs and questionnaires: contact us.