- Unique production database authentication enforced
- Encryption key access restricted
- Unique account authentication enforced
Controls
Updated Sep 15, 202666 controls monitored continuously across five domains.
- Asset disposal procedures utilized
- Production inventory maintained
- Portable media encrypted
- Data encryption utilized
- Control self-assessments conducted
- Penetration testing performed
- Continuity and Disaster Recovery plans established
- Continuity and Disaster Recovery plans tested
- Cybersecurity insurance maintained
- Data retention procedures established
- Customer data deleted upon leaving
- Data classification policy established
Subprocessors
- Amazon Web Services (AWS)Cloud Hosting Provider
Public cloud infrastructure for production application services, encrypted datastores, and backups.
- Microsoft AzureCloud Provider
HIPAA-eligible cloud services for document processing and enterprise identity integration.
- Google CloudCloud Provider
HIPAA-eligible cloud services under a Business Associate Agreement, including Vertex AI model inference for clinical documentation review and appeal drafting. No model training on inputs, prompts, PHI, or client business data.
- Firebase (Firestore & Authentication)Identity Provider & Database
Firebase Authentication provides sign-in, single sign-on, and multi-factor enforcement for our applications; Cloud Firestore stores encrypted application data under Google Cloud's HIPAA BAA.