AI trust & security

Built to be defensible, not just compliant.

HIPAA is the floor, not the ceiling. Below is exactly what we hold today, what is designed into the platform, and what we do not have yet — because a security page is only worth reading if it is true.

Request our security packet Back to the agents

Plainly

What we do not have yet

We are an early-stage company. We do not hold a SOC 2 report, we are not HITRUST certified, and we have not completed a third-party penetration test. Plenty of vendors our size imply otherwise on a page like this. We would rather tell you plainly and let you judge the controls we can actually demonstrate today.

Every row in the status table below is reviewed at least quarterly. When our position changes, this page changes the same week — not when a deal depends on it.

The six rules that are not configurable

No agent ever diagnoses, triages, prescribes, or interprets a result.
No note, charge or claim is released without a human signature or a certified reviewer.
No PHI leaves the United States, and none of it trains a shared model.
No write-off, refund, disclosure or records release happens without human approval.
No password is shared, reused or stored in plain text — including payer portals.
No configuration change reaches production without a version, a test and a rollback path.

Controls

Six areas, documented and reviewable.

These describe how the platform is designed and what we commit to contractually. Where something is not yet built, tested or audited, the status table below says so rather than leaving you to guess.

Protected health information

A signed Business Associate Agreement before any PHI moves — ours or yours, your choice
PHI encrypted in transit (TLS 1.2+) and at rest (AES-256), with keys managed in a dedicated key service
US-only data residency, including backups and disaster recovery
Contractual prohibition on using your PHI to train any shared or third-party model
De-identification at the edge wherever a task does not require identified data
Retention periods set by you and enforced automatically, with deletion logged and provable

Access control

Named individual accounts only — no shared logins, ever
Multi-factor authentication required for every human with PHI access
Role-based least-privilege access, reviewed quarterly and revoked on offboarding within one hour
Agent service accounts scoped to specific systems, actions and time windows
Secrets and payer portal credentials held in a vault, never in code or configuration files
Break-glass access requires a reason, is time-boxed and triggers notification

Audit and accountability

Immutable audit log of every agent action: input, decision, action, confidence, model version, timestamp
Reasoning trace retained so any decision can be reconstructed months later
Human reviewer identity recorded on every approval, correction and override
Logs exportable as CSV or JSON at any time, including at contract end
Anomaly detection on access patterns and bulk record access
Annual third-party penetration test with a remediation report available under NDA

Agent guardrails

Confidence thresholds: below threshold, the agent cannot act — it queues for a human
Scope limits: each agent has an explicit list of systems and actions it may touch
Clinical boundary: no agent diagnoses, triages, prescribes or interprets results
Reversibility: bookings, filings and postings can be undone with a full trace
Kill switch per agent, per workflow and per practice, effective within minutes
Prompt-injection and jailbreak testing against every agent before each release

Regulatory position

HIPAA Privacy, Security and Breach Notification Rules — administrative, physical and technical safeguards documented
21st Century Cures Act information-blocking rules respected in every integration
TCPA-compliant consent, opt-out and quiet-hours handling for SMS
State two-party consent rules applied to call recording by area code, with consent logged
Telehealth and documentation rules tracked state by state as they change
We are a business associate, not a covered entity — we never sell data, and we do not advertise to your patients

Operations and resilience

Encrypted, tested backups with documented recovery time and recovery point objectives
Documented incident response with breach notification inside the regulatory window
Failover: if an agent is unavailable, calls route to your existing line and work queues to your staff
Change control with versioned prompts and models, and rollback for every release
Workforce HIPAA training on hire and annually, with completion recorded
Subprocessors listed in writing, each under its own BAA, and you are notified before any change

Status

What is in place, today.

Control	Status	Detail
HIPAA safeguards	In place	Administrative, physical and technical safeguards documented, with a signed BAA before any PHI is exchanged.
Business Associate Agreements	Available now	We sign ours or yours before a single record moves, and every subprocessor signs one too.
Data residency	United States	We do not process, store or back up protected health information offshore.
Model training on client data	Never	Contractual, and it flows down to every model provider and subprocessor we use.
Encryption	TLS 1.2+ / AES-256	In transit and at rest on every system we control, with managed key rotation.
Access control	MFA + least privilege	Named individual accounts, no shared logins, quarterly access review, one-hour revocation on offboarding.
Audit logging	Designed in	Immutable action log with reasoning trace, model version and reviewer identity on every agent action.
SOC 2 Type II	Not held — preparing	We do not have a SOC 2 report today and will not claim one. Ask us where our readiness work stands.
HITRUST	Not pursued	HITRUST is a later-stage certification for us. We will say that rather than imply otherwise.
Penetration testing	Not yet completed	We will commission independent testing before enterprise deployment and share the report under NDA.

Rows marked Not held, Not pursued or Not yet completed are our honest gaps. We update them in tools/agents.py → SECURITY_STATUS the week our position changes, so this page stays ahead of the sales conversation rather than behind it.

FAQ

Security questions, answered plainly.

Are you HIPAA compliant?

We operate under HIPAA's requirements as a business associate: signed BAAs, documented administrative, physical and technical safeguards, workforce training, access controls, encryption, audit logging and breach procedures. We will give you our security packet and complete your security questionnaire before you sign anything.

Where is patient data stored?

In the United States, exclusively — production, backups and disaster recovery. We do not use offshore processing for any system that touches PHI, and our subprocessors are listed in writing under their own BAAs.

Do you train models on our data?

No. It is a contractual commitment, and it flows down to every model provider and subprocessor we use. Your data improves your configuration; it does not improve a shared model.

What happens if an agent makes a mistake?

It is logged, traceable and reversible. Below-threshold work never gets actioned in the first place, and every action carries the inputs that produced it — so you can see what happened, correct it and prove the correction.

Can we audit you?

Yes. We support your audit, your payer's audit, and your buyer's diligence. You can export the complete action log at any time, and we retain audit workpapers for the period your record-retention policy requires.

What is your breach notification commitment?

Notification without unreasonable delay and inside the regulatory window, with the scope, the affected records and the remediation already determined. We do not wait for a legal review to tell you something happened.

Do agents create a HIPAA risk we should document?

Yes, and it should be in your risk analysis. We provide the agent inventory, data flows and safeguards documentation you need for that analysis, and we will review it with your compliance lead.

Is there a vendor lock-in risk with AI?

Deliberately low. Configuration, prompts, routing rules and logs are yours and exportable in a standard format. The agents integrate through your EMR, so the systems of record stay yours either way.

Put us through your security review.

Send your security questionnaire and we will complete it before you sign anything — including the parts that are inconvenient to answer.

Request our security packet See the agents

A 30-minute call with an operations lead. No obligation, no sales sequence, and we will say so if you do not need us.