Encrypted everywhere
TLS in transit, AES-256 at rest, KMS-managed keys, AWS US regions.
Trust center
Security you can review before you buy
Review public controls, policy paths, subprocessors, system status, and our completed SOC 2 Type I examination (Johanson Group LLP; report date June 19, 2026).
Production delivery to trading partners runs over AS2 and SFTP. Custom connections start in Lab, use Certification for real partner testing, and enter Production only after partner sign-off and go-live approval. Platform status
SOC 2 Type IHIPAA CompliantBAA review path
How your data is handled
Retention choices
Document retention follows the selected plan and any purchased Vault option; no universal WORM term is implied.
Healthcare service scope
Review which service paths are conditional, metadata-only, or prohibited for HIPAA and Part 2 data.
SOC 2 Type I
Independent examination · Report date: June 19, 2026
HIPAA Compliant
Posture under an executed BAA · PHI only after BAA + activation
ISO 27001
readiness path; no certification claimed
Status
current operational state on /status
Common diligence questions
What is the SOC 2 Type I examination?
SignalEDI completed an independent SOC 2 Type I examination (Johanson Group LLP). Report date: June 19, 2026. A Type I report describes controls at a point in time; it is not a Type II report over a period. The full report is available to customers under NDA on request — sign in to your account and open Help → Open a ticket (choose Compliance) to request it. Prospects who are not yet customers can email sales@signaledi.com. There is no public download.
Can our auditor get access?
Review role-scoped access and export requirements during diligence; availability depends on the applicable workspace and plan controls.
Where does data live?
Confirm current hosting, residency, and subprocessor details on the public security and policy paths during procurement.
Is SignalEDI HIPAA Compliant?
Yes — SignalEDI supports HIPAA compliance for covered-entity and business-associate customers under an executed BAA: platform controls plus the HIPAA/BAA add-on path, with PHI only after BAA execution and tenant activation. Seasonal and Starter map, validate, and test healthcare X12 with synthetic or de-identified data only.
Do you sign BAAs?
Yes — on Growth and Enterprise via the HIPAA/BAA add-on (included on Enterprise; published rate on /pricing). Seasonal and Starter map, validate, and test healthcare X12 with synthetic or de-identified data only. An executed BAA is required before transmitting PHI. Complete execution in checkout or contact support / compliance for custom redlines.
Can Part 2 records go to external AI?
No. The current baseline denies suspected 42 CFR Part 2 content before external OpenAI, Anthropic, Bedrock, or OCR transmission.
Pen tests?
Ask for the current diligence-artifact inventory. This page does not promise a report or redacted summary without dated evidence.
Need implementation-specific detail?
Start with public policies and status, then request the current evidence inventory for your review scope.