We build to the controls your security and risk teams expect: access, encryption, deployment, and governance. Architected to SOC 2 and NIST 800-53, HIPAA-aligned, and governed by the NIST AI Risk Management Framework. We walk your security team through the evidence behind each control.
Architected to both control sets, with evidence your team can review.
Patient data excluded by default and brought in only under a signed BAA.
Every request verified under your identity provider and your policies.
Your cloud account, your servers, or fully offline. Data never leaves.
Every control on this page is one we will put behind a signature and walk your security team through.
A BAA, DPA, or NDA in place first, with breach-notification commitments in the contract.
We map our controls to your requirements and show your team how each one works.
SIG, CAIQ, or your own, answered with specifics by a named contact.
Each control, what it means in practice, and the evidence behind it.
Works with your existing sign-in (Okta, Microsoft Entra, and others). Accounts created and removed from your own directory. Multi-factor sign-in required; no shared passwords.
Access by role, with finer rules where needed. Temporary elevated access that expires. Separate people for anything important.
Sign-in and access events written to a tamper-proof log. Credentials rotated or revoked on request. Access reviews you can export for audit.
AES-256 when stored, TLS 1.3 when sent, including between services. Keys in your key service, with customer-managed keys available. Secrets in a central vault, never in code.
Personal and patient data removed or masked before processing. Only what the process needs is collected and kept. Retention windows you set, with verifiable deletion.
Data kept in the region you require. Clear separation from anyone else's data. Documented data flows. Your data is never used to train shared or third-party AI.
Runs in your own cloud account and private network, with private connections and no public exposure.
Installed inside your existing infrastructure and controls. Your operators, your change process, your monitoring.
Operates disconnected, with AI and updates delivered offline in a hardened, separated setup.
Penetration testing, ongoing vulnerability scanning, automated code and dependency analysis, and supply-chain review before every release.
Peer review, restricted deployment paths, and signed, reproducible releases.
Events streamed to your security monitoring tools, tamper-proof audit logging, and a documented incident-response plan with breach notification in the contract.
When your engagement requires specific attestations, we map our controls to your requirements, show the evidence, and put the commitments in the contract.
Architected to SOC 2 Type II and NIST 800-53; control mapping aligned to NIST CSF 2.0; tamper-proof records and evidence you can review.
HIPAA and HITECH-aligned handling of patient data with a signed BAA; GDPR and CCPA / CPRA privacy by design with a signed DPA; individual data rights and verifiable retention built in.
Ready for SIG and CAIQ questionnaires; public sector designed toward FedRAMP and StateRAMP baselines; responsive to vendor security assessments and audits.
Important output is tied to your source documents, checked against accuracy thresholds, and sent to a named person before it takes effect.
A master agreement and statements of work, plus a BAA, DPA, or NDA as needed, with breach-notification and security commitments in the contract.
You own the code and intellectual property we deliver. Documented handover and training every phase. Your team keeps what we build.
Delivery by the people who scope the work, from the United States. Responsive to security questionnaires and reviews, with a named contact for security and compliance questions.
SIG, CAIQ, or your own. Straight answers on architecture, deployment, and governance, with evidence behind each one.