> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rcintell.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Center

> Security, compliance, and data handling policies

## Security

* **Encryption in transit** — All API traffic uses TLS 1.2+
* **Encryption at rest** — All data encrypted at rest using AES-256
* **API key security** — Keys are SHA-256 hashed before storage. Only the prefix is retrievable
* **Multi-tenant isolation** — Complete data isolation between tenants at the database level
* **Rate limiting** — Redis-backed sliding window rate limiting per API key

## SENTINEL audit

Every AI agent decision is audited by SENTINEL, scoring:

* **PHI Exposure** — Detection of patient identifiers in reasoning traces
* **Security Compliance** — Prevention of unauthorized data access
* **Failover Safety** — Safe error handling without data leakage
* **Treatment Safety** — Prevention of unsafe clinical decisions

## Data handling

* **No PHI storage by default** — Knowledge resolution uses facility identifiers (CCN), not patient data
* **Agent job data** — Queries and results are stored per-tenant and can be purged via API
* **Audit logs** — Retained for 90 days (Pro) or custom retention (Enterprise)
* **Data residency** — US-based infrastructure. Contact us for specific requirements

## Compliance

* SOC 2 Type II (in progress)
* HIPAA BAA available for Enterprise plans
* HITRUST CSF assessment (planned)

## Responsible AI

* All agent outputs include confidence scores and audit tiers
* Red-tier decisions (\< 0.60 confidence) are flagged for human review
* Reasoning traces are available for every agent decision
* No patient data is used in agent training