Your records never train an AI model. Ever.
Not ours, not a vendor's, not "de-identified for research." Your files are processed to produce your outputs, and that is the end of their journey. This is contractual (it's in the BAA), not a settings toggle.
What we do learn from is the software: which features get used, how long a review takes, where a draft gets corrected, what fails. That telemetry is engineered to exclude record content: the number of edits a draft receives is ours to measure, the edit itself is not. The boundary is written down in Terms Section 8.3.
6 controls your reviewer will ask about.
TLS 1.2+ in transit, AES-256 at rest, for every file and every environment.
HIPAA-minimal by default: people see only the cases assigned to them. Nothing else exists for them.
Every PHI access event is logged: who, what, when. Exportable for your own audits, appeals, and records requests.
Token-validated sessions with strict expiry handling. No shared credentials, anywhere.
Readiness report dated November 3, 2026, free to download. Controls documentation and evidence packages under NDA.
Every output cited, reviewable, and traceable to its source. AI does the reading and helps your experts make the call. The last word is theirs.
Download our compliance reports.
Both reports are dated . Attach them to your vendor review or forward them to procurement. No form, no NDA.
SOC 2 readiness report
Every SOC 2 control we run, mapped to the criteria it answers, with its current monitoring status.
HIPAA readiness report
Every HIPAA Security Rule safeguard we address, with the controls and checks behind each one.
These are readiness reports from continuous control monitoring in Sprinto, not an auditor's attestation. Need the full evidence package, penetration-test summaries or a countersigned BAA/DPA? Request them under NDA below. Evaluating us for your team? Read the 16-answer FAQ, each answer linked to its source.
Deployment and integration
For carriers, TPAs, and public-sector programs deploying at scale.
Secure REST API and CRM token exchange, no shared credentials, with outbound webhooks into your case-management and claims systems.
Per-feature, per-file metering, so you can bill costs back to a case, a client program, or a desk.
Retention controls, de-identified export for sharing without exposing PHI, and deletion on request.
Watch the safeguards behind every case
Who touches your data, and what happens if something goes wrong.
Notice of any breach of unsecured PHI without unreasonable delay, and in no event later than 72 hours after we confirm it, as set out in the DPA and the BAA.
4 vendors, all under BAA, zero-retention, no-training. Your files are stored on AWS in US data centers. Every AI model request goes through OpenRouter, mostly to open-source models, with Anthropic and OpenAI as a backup reached only through OpenRouter. Full detail: Subprocessor List.
Customer Content is processed in the US only. At termination, PHI is returned within a 30-day export window, then destroyed (including backups) with a deletion certificate.