Docs / Security & compliance

How we handle PHI

Where data lives

Everything runs on HIPAA-eligible AWS services under AWS’s Business Associate Agreement with us: documents in S3, case data in DynamoDB, all encrypted at rest with AWS KMS customer-managed keys and in transit with TLS. Backups are continuous (35-day point-in-time recovery).

The document AI

Extraction and drafting run on Amazon Bedrock — inside the same AWS environment as the rest of the platform. Your documents are not sent to third-party AI companies, and per AWS’s Bedrock terms, your data is never used to train models. Prompts and outputs stay within the service.

What never happens

• No selling or sharing of your data with third parties
• No model training on your documents
• No PHI in notification emails (e-signature requests, reminders) — emails carry identifiers only where operationally required, never clinical content
• No PHI required in sandbox mode at all

Your obligations

HIPAA is a two-party affair: sign the BAA before real patient data, use real-identity logins per team member (no shared accounts — the audit trail depends on it), and remove departed staff promptly via Settings → Members.