Trust center
Where every control stands, today.
An honest status instead of a row of badges: what is in place, in progress and planned, updated as each one lands.
Compliance program
Status, item by item.
Last updated October 12, 2026
In place3
- BAA template for clients and vendorsAvailable on request; signed before any data moves.
- Conflicts of interest policyPublished at /legal/conflicts.
- Marketing site collects no PHINo uploads, no claim data, no third-party trackers.
In progress2
- HIPAA risk analysis and policiesDrafting with counsel before the first client data arrives.
- Row-level isolation, encryption, audit logDesigned into the portal and engine now in build.
Planned3
- Penetration testBefore the first hospital client.
- SOC 2 Type ITarget Q1 2027, run on a compliance automation platform.
- SOC 2 Type IIObservation window starts after Type I.
Subprocessors
Who will touch your data, and on what terms.
Categories planned for the platform. We name each vendor here before any client data reaches it, with 30 days notice of changes.
| Category | Purpose | Data and terms |
|---|---|---|
| Cloud hosting (US regions) | Application, database, storage | PHIBAA required |
| Managed Postgres and auth | Database, authentication, row-level security | PHIBAA required |
| Large language model API | Extraction and drafting, no training on our data | PHIBAA required |
| Document OCR | Reading EOBs and letters | PHIBAA required |
| Fax and email delivery | Notices to payers; no PHI in email bodies | PHI for faxBAA required |
| Website hosting (Netlify) | This marketing site and its forms | No PHI |
Send us one month of remits.
We’ll show you what you left on the table.
Seven business days. No cost. A line-by-line report of eligible claims you didn’t file, QPAs that don’t add up, and awards you were never paid.