Encrypted everywhere
TLS in transit, AES-256 at rest, KMS-managed keys, AWS US regions.
Trust center
Security you can review before you buy
Review public controls, policy paths, subprocessors, and system status without assuming a certification or private report is currently available.
Signal workspace
Validated, routed, acknowledged.
Partner rules checked
Human decisions drafted
Receipts attached
How your data is handled
Retention choices
Document retention follows the selected plan and any purchased Vault option; no universal WORM term is implied.
Healthcare service scope
Review which service paths are conditional, metadata-only, or prohibited for HIPAA and Part 2 data.
SOC 2 readiness
work; no public report claimed
Healthcare
control readiness + BAA review path
ISO 27001
readiness path; no certification claimed
Status
current operational state on /status
Common diligence questions
Can our auditor get access?
Review role-scoped access and export requirements during diligence; availability depends on the applicable workspace and plan controls.
Where does data live?
Confirm current hosting, residency, and subprocessor details on the public security and policy paths during procurement.
Do you sign BAAs?
Yes — a BAA is available on any paid plan via the HIPAA/BAA add-on (included on Enterprise; published rate on /pricing). An executed BAA is required before transmitting PHI. Complete execution in checkout or contact support / compliance for custom redlines.
Can Part 2 records go to external AI?
No. The current baseline denies suspected 42 CFR Part 2 content before external OpenAI, Anthropic, Bedrock, or OCR transmission.
Pen tests?
Ask for the current diligence-artifact inventory. This page does not promise a report or redacted summary without dated evidence.
Need implementation-specific detail?
Start with public policies and status, then request the current evidence inventory for your review scope.