Trust and scope
What the platform processes, and what it does not.
The platform is not a PHI system. No field accepts protected health information, and no clinical data flows into it. We do not describe the platform as HIPAA compliant or SOC 2 certified, because we do not claim certifications we do not hold.
The platform processes
Vendor questionnaire responses
Vendor policy and architecture documents
Subprocessor registers and agreement status
Reviewer scores, ratings and rationale
Findings, severity tiers and sample contract controls
The platform does not process
Protected health information
Clinical records or encounter content
Patient identifiers of any kind
Live data flows from clinical systems
Model inference on patient data
Security
Controls in place, stated plainly.
Where a control is a configuration option rather than a default, this says so.
AccessSingle sign on and least privilegeSAML single sign on with SCIM provisioning, role based access control, and enforced multi factor authentication.
DataEncryption in transit and at restTLS 1.2 or above in transit, AES-256 at rest, with key rotation on a defined schedule.
IsolationTenant separationCustomer records are logically separated, and no customer data is used to improve the service for another customer.
ScopeNo PHI in the platformThe platform is designed not to collect protected health information, and customers are instructed not to enter it.
ResilienceBackup and recoveryEncrypted backups with defined recovery point and recovery time objectives, tested on a regular cycle.
AssuranceIndependent testingA documented vulnerability disclosure route and a defined remediation process for reported issues.
Framework mapping
NIST AI RMF 1.0, ISO/IEC 42001, HHS ASTP/ONC HTI-1 and CHAI.
Mapped and aligned describe how the platform is structured against these frameworks. They are not certifications.
| Framework or function | How the platform supports it | Reference |
|---|---|---|
| Govern | Defined roles, a documented scoring rubric, published severity tiers and an audit ledger of every decision. | Management system and roles |
| Map | Intake and scoping establish deployment context, clinical setting, autonomy level and applicable statutory overlays. | Context of the organization |
| Measure | Weighted domain scoring, evidence confidence rated separately, severity tiering with score ceilings. | Performance evaluation |
| Manage | Findings register, corrective action tracking, sample contract control generation and reassessment triggers. | Operational planning and control |
| HHS ASTP/ONC HTI-1 | Predictive decision support intervention (DSI) transparency: source attributes for intended use, training data provenance, fairness measures and risk management disclosures are requested from the vendor in HTI-1 terms. | DSI source attributes (§170.315(b)(11)) |
| CHAI Assurance Standards Guide | Local validation testing before deployment, subgroup bias auditing across demographic and clinical cohorts, and continuous post-deployment monitoring with defined reassessment triggers. | Assurance standards guide |
Enterprise controls
What is default and what is contractual.
| Control | Availability | Notes |
|---|---|---|
| Single sign on and SCIM provisioning | Enterprise360 | Enforced at the tenant level |
| Role based access control | All plans | Roles driven by directory group membership where SSO is enabled |
| Data residency commitment | Enterprise360 | Stated in the agreement |
| Uptime commitment | Enterprise360 | Stated in the agreement |
| Full record export | All plans | Available at any time, including at exit |
| API access | Read only on ClinicalGuard, full on Enterprise360 | Custom and imported questions on Enterprise360 |
Our subprocessors
We ask vendors to name their chain. Here is ours.
Every third party that processes data on our behalf, its function, its region and its agreement status. No subprocessor receives PHI, because the platform holds none. Updated on change; customers on Enterprise360 receive thirty days’ notice.
| Function | Purpose | Region | Agreement |
|---|---|---|---|
| Cloud hosting | Compute, storage, backup | United States | Executed |
| Transactional email | Notifications to reviewers and vendors | United States | Executed |
| Authentication (SSO/SCIM) | Identity federation | United States | Executed |
| Error and uptime monitoring | Application telemetry, no customer content | United States | Executed |
| Document rendering | Export of packets and ledgers | United States | Executed |
Provider names are disclosed to customers and prospects under NDA.One-page security overview →
Diligence
What your security team receives.
Documentation is available on request as the program matures.
QuestionnaireYour standard form, completedOn request.
ArchitectureData flow and hosting detailOn request. Where data is stored and processed, which regions are involved, and who can access it.
SubprocessorsOur own chain, enumeratedPublished. Every subprocessor we use, its function, its region and its agreement status.
Security & Platform Architecture