Security and Compliance | CercaLabs

Security & compliance

What your security team needs from us, in one place

Written to be read by a reviewer rather than filed by a salesperson. Specific commitments, in the language your security questionnaire already uses.

Reviewed and accurate as of August 2026.

Protected health information

How We Handle PHI

We operate under a BAA, inside your environment wherever your architecture allows, on a minimum-necessary basis, with audit logging on every automated action. Where AI models are involved, clinical text is de-identified before it reaches a model.

Control area Our position
Business associate agreement Signed before any engagement touching PHI. We will work from your template. What a BAA is.
Minimum necessary Access scoped per workflow. We request the narrowest access that does the job, and document why each element is needed.
Environment We work inside your tenancy and boundary wherever your architecture allows, rather than moving data to us.
Access control Named individual accounts, no shared credentials, MFA, and revocation on the final day of the engagement.
Audit logging Every automated action logged with inputs, outputs, and the screen or endpoint acted on. Retained per your policy.
AI model boundary De-identification before inference, contracted terms with no training on your data, and request logging held by you.
Development lifecycle HIPAA-aligned SDLC: code review, change control, separated environments, and no PHI in non-production.
Incident response A named contact, a defined notification path, and a same-day escalation commitment for automation failures.
Data return Return or destruction on termination per the BAA, confirmed in writing.

Scope of review

Where We Sit In Your Boundary

We are a consulting partner, not a platform. We build and operate inside your environment, under your controls, governed by a BAA. We do not host your data, and we do not ask you to extend your boundary to cover a vendor system.

That distinction matters for a security review. The systems we build inherit your environment’s posture rather than introducing a separate one to assess. What your reviewer is evaluating is our access, our people, and our development practice, all of it set out above, and all of it documented in whatever format your process requires.

What a reviewer is actually assessing

Our access

Which accounts, scoped to which workflows, for how long.

Our people

Named individuals on the engagement, with access records per person.

Our practice

Change control, separated environments, and what gets logged when automation acts.

Questions we get asked

Security Questions

Will you sign a BAA?

Yes. We sign a business associate agreement before any engagement that involves protected health information, and we will work from your template.

Do you use subcontractors?

Our delivery team is in-house. Where a cloud or model provider processes data on your behalf, we name it, hold the appropriate agreement with it, and disclose it in writing. Ask for the list and you will have it before you sign.

Where does data live?

Wherever your policy requires. Most engagements run inside the client’s own environment and cloud tenancy. Where a model provider is involved, region and retention terms are part of the design decision, not an afterthought.

How do you fit into our security review?

As a consulting partner working inside your environment, not a platform holding your data. We complete security questionnaires, sign your BAA, and provide named-individual access records for everyone on the engagement. Send the questionnaire early and we will turn it around before it becomes a contract-stage surprise.

What happens when an engagement ends?

Return or destruction per the BAA, with written confirmation. Access is revoked on the last day, not the last invoice.

Can a workflow run without PHI at all?

Often, yes, and where it can, we build it that way. De-identifying or tokenizing before data moves narrows what your reviewer has to assess and limits exposure if something goes wrong downstream.

Next step

Send The Questionnaire Early

If a security review is what stands between you and starting, put it at the front of the process rather than the end. We will complete it before scoping, so nothing surfaces late.

Book a teardown