We encrypt data in transit and at rest.
Data is encrypted in transit using TLS and at rest using industry-standard encryption, governed by our Encryption and Key Management Policy.
We protect customer data as a trust.
Customer data is something we are trusted with, not something we own. Full policies, live control monitoring and audit documents are on our trust center.
Trust centerA seed vault in the far north keeps seeds that still belong to the people who sent them.
These are our security commitments.
We grant the least access a job needs.
Access to systems and customer data is granted on a least-privilege basis and reviewed under our Access Control and Termination Policy.
We evaluate every vendor before use.
Third-party vendors are evaluated before use and tracked under our Vendor Management Policy, consistent with our own commitments to customers.
We notify customers when an incident affects them.
If a security incident affects customer data, we investigate and notify affected customers under our Security Incident Response Plan.
Independent assurance supports our security program.
We maintain 23 security and privacy policies covering access control, change management, incident response and vendor management, with continuous control monitoring through Secureframe. A-LIGN is engaged for SOC 2 Type I and Type II examinations, which are in progress.
We run a HIPAA security program.
We sign business associate agreements with covered-entity customers, maintain a signed ePHI risk analysis and HIPAA policy extensions, and train our workforce on HIPAA requirements. Google Cloud hosts our agent platform, databases and protected storage. Patient-data model inference uses approved Azure OpenAI routes under Microsoft’s business associate agreement.
Our security team helps you complete vendor diligence.
We provide business associate agreements, security questionnaires and information about our data handling, subprocessors, retention and deletion. Detailed policies and assurance materials are shared directly with authorized reviewers through our trust center and security team.
Controls protect each practice and its connected systems.
Practice-specific identities, access controls and source permissions govern access to information and connected services. Monitoring, audit records, backups and incident response support our production operations.
Our privacy policy explains how we handle service information. Contact the security team for the materials your review requires.
Patient data stays on approved healthcare routes.
Hosting and model inference have distinct roles. A cloud agreement does not approve every model or service for patient data. Customer data is not used to train shared or cross-customer models.
OliMed uses the Olito Labs managed-agent platform, also described as Agent Oli in the trust center. Our security team provides the OliMed-specific data flow, applicable services and subprocessor roles for a healthcare review.
Retention and deletion follow the applicable agreement, data category and legal requirements. Authorized reviewers can request the retention schedule, deletion process and backup treatment alongside the available assurance materials.
Report a security concern to us by email.
For a security review, a question about our program or a vulnerability report, contact our security team.