Security
- Encryption in transit — All API traffic uses TLS 1.2+
- Encryption at rest — All data encrypted at rest using AES-256
- API key security — Keys are SHA-256 hashed before storage. Only the prefix is retrievable
- Multi-tenant isolation — Complete data isolation between tenants at the database level
- Rate limiting — Redis-backed sliding window rate limiting per API key
SENTINEL audit
Every AI agent decision is audited by SENTINEL, scoring:- PHI Exposure — Detection of patient identifiers in reasoning traces
- Security Compliance — Prevention of unauthorized data access
- Failover Safety — Safe error handling without data leakage
- Treatment Safety — Prevention of unsafe clinical decisions
Data handling
- No PHI storage by default — Knowledge resolution uses facility identifiers (CCN), not patient data
- Agent job data — Queries and results are stored per-tenant and can be purged via API
- Audit logs — Retained for 90 days (Pro) or custom retention (Enterprise)
- Data residency — US-based infrastructure. Contact us for specific requirements
Compliance
- SOC 2 Type II (in progress)
- HIPAA BAA available for Enterprise plans
- HITRUST CSF assessment (planned)
Responsible AI
- All agent outputs include confidence scores and audit tiers
- Red-tier decisions (< 0.60 confidence) are flagged for human review
- Reasoning traces are available for every agent decision
- No patient data is used in agent training