Protecting PHI is non-negotiable — and stated honestly.
HIPAA-compliant with BAAs available today. SOC 2 Type II audit in progress. HITRUST on the roadmap. We show you exactly where every certification stands, because in healthcare, overclaiming your security posture is itself a risk.
- HIPAA + BAAs today on AWS HIPAA-eligible infrastructure
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- SMART on FHIR / OAuth2 / OIDC, RBAC, consent & immutable audit
- Deploy in cloud, single-tenant VPC or on-prem — you keep the data
In short
Security & Compliance
Enterprise-grade trust, stated honestly
Protecting PHI is non-negotiable. Here's exactly where our certifications stand — no overclaiming.
Compliant · BAAs available
Audit in progress
On roadmap
Native, by design
AWS HIPAA-eligible infrastructure · Business Associate Agreements (BAAs) · Encryption in transit & at rest · See our security details →
Certification status, without the spin
The single most important thing on this page: what is real today versus in progress versus planned. We never present an unfinished audit as a finished certification.
| Item | Status | Detail |
|---|---|---|
| HIPAA compliance | Active today | We operate as a HIPAA Business Associate and sign BAAs. Administrative, physical and technical safeguards are in place for the PHI we process. |
| Business Associate Agreements (BAAs) | Active today | Available to every customer before any PHI is exchanged. We in turn hold BAAs with our infrastructure subprocessors. |
| AWS HIPAA-eligible infrastructure | Active today | Hosted on AWS HIPAA-eligible services under an AWS Business Associate Addendum, with encryption, isolation and least-privilege access. |
| SOC 2 Type II | In progress | An independent SOC 2 Type II audit is underway. We do not claim a completed SOC 2 certification and will publish the report to customers under NDA once the observation period concludes. |
| HITRUST CSF | On roadmap | HITRUST certification is planned to unlock payer and large-provider procurement. It is a roadmap item today — not a certification we hold. |
| Penetration testing & vuln management | Active today | Third-party penetration testing and ongoing vulnerability management, with tracked remediation. |
SOC 2 Type II and HITRUST are the bar to sell into payers and health systems. We treat them as a gating investment, not an afterthought — and we'll tell you exactly where we are in the process during security review.
The controls that protect your data
Defense in depth across encryption, identity, access, consent, audit, infrastructure and monitoring — several of them owned by the Compliance agent.
Encryption everywhere
TLS 1.2+ for data in transit and AES-256 for data at rest, with managed keys and rotation. PHI is never written or transmitted in the clear.
SMART on FHIR, OAuth2 & OIDC
Standards-based authorization for FHIR access — SMART App Launch 1.0.0, OAuth2 scopes and OpenID Connect Core 1.0 — the exact identity stack CMS-0057-F requires.
Role-based access control
Least-privilege RBAC scopes every user, service and API key to only the data and actions it needs, enforced by the Compliance agent's PHI-handling guardrails.
Consent management
FHIR Consent and Provenance are first-class. The Compliance agent reasons about consent scope so data is only shared where a patient or policy permits.
Immutable audit trail
Every message, mapping decision and data access is recorded in a tamper-evident, append-only log — the evidence auditors, procurement and incident response need.
AWS HIPAA-eligible infrastructure
The platform runs on AWS HIPAA-eligible services under an AWS Business Associate Addendum, with network isolation, security groups and hardened baselines.
Data residency & VPC / on-prem
Deploy in a single-tenant VPC or on-premises to keep PHI inside your boundary and meet residency requirements — a control API-network models can't offer.
Anomaly & abnormal-access detection
The Compliance agent watches for policy violations and abnormal access patterns, and the Observability agent flags anomalies in message volume and behavior.
Penetration testing
Independent third-party penetration testing and ongoing vulnerability management, with remediation tracked as part of the security program.
Security as an agent, not an afterthought
The Compliance agent in the fleet enforces security, consent and provenance across every transformation: it manages consent scope, writes an immutable audit record, applies SMART / OAuth2 / OIDC and RBAC policy, guards PHI handling, and flags abnormal access and policy violations. Because it sits in the data path rather than beside it, compliance is applied to every message the platform touches — not just sampled after the fact. And because every AI-drafted mapping is human-reviewed, versioned and auditable, you always have the evidence trail a healthcare data error demands.
Where your data goes — and doesn't
Clarity on infrastructure, subprocessors and deployment, so security review is a short conversation, not an investigation.
Infrastructure
AWS HIPAA-eligible services under an AWS Business Associate Addendum, with network isolation, hardened baselines and least-privilege service roles.
Subprocessors
A short, disclosed list of subprocessors, each under a BAA where PHI is involved. A current list is available as part of security review.
Your boundary
Choose multi-tenant cloud, single-tenant VPC or on-prem. In VPC/on-prem, PHI never leaves your environment — the control API networks can't match.
Frequently asked questions
Run us through your security review.
We'll walk your team through our HIPAA posture, the SOC 2 Type II audit status, our subprocessors and deployment options — and answer the hard questions honestly.