Security & compliance
Written to be read by a reviewer rather than filed by a salesperson. Specific commitments, in the language your security questionnaire already uses.
Reviewed and accurate as of August 2026.
Protected health information
We operate under a BAA, inside your environment wherever your architecture allows, on a minimum-necessary basis, with audit logging on every automated action. Where AI models are involved, clinical text is de-identified before it reaches a model.
Scope of review
We are a consulting partner, not a platform. We build and operate inside your environment, under your controls, governed by a BAA. We do not host your data, and we do not ask you to extend your boundary to cover a vendor system.
That distinction matters for a security review. The systems we build inherit your environment’s posture rather than introducing a separate one to assess. What your reviewer is evaluating is our access, our people, and our development practice, all of it set out above, and all of it documented in whatever format your process requires.
What a reviewer is actually assessing
Our access
Which accounts, scoped to which workflows, for how long.
Our people
Named individuals on the engagement, with access records per person.
Our practice
Change control, separated environments, and what gets logged when automation acts.
Questions we get asked
Will you sign a BAA?
Yes. We sign a business associate agreement before any engagement that involves protected health information, and we will work from your template.
Do you use subcontractors?
Our delivery team is in-house. Where a cloud or model provider processes data on your behalf, we name it, hold the appropriate agreement with it, and disclose it in writing. Ask for the list and you will have it before you sign.
Where does data live?
Wherever your policy requires. Most engagements run inside the client’s own environment and cloud tenancy. Where a model provider is involved, region and retention terms are part of the design decision, not an afterthought.
How do you fit into our security review?
As a consulting partner working inside your environment, not a platform holding your data. We complete security questionnaires, sign your BAA, and provide named-individual access records for everyone on the engagement. Send the questionnaire early and we will turn it around before it becomes a contract-stage surprise.
What happens when an engagement ends?
Return or destruction per the BAA, with written confirmation. Access is revoked on the last day, not the last invoice.
Can a workflow run without PHI at all?
Often, yes, and where it can, we build it that way. De-identifying or tokenizing before data moves narrows what your reviewer has to assess and limits exposure if something goes wrong downstream.
Next step
If a security review is what stands between you and starting, put it at the front of the process rather than the end. We will complete it before scoping, so nothing surfaces late.
Book a teardown