Security & trust

How we protect your data, and what we have not finished yet.

Trust comes from stating what is built, what is signed, and what is still in progress. Each item below is one of those three.

Ask a security question Read the BAA terms

Built

In the product today.

Data protection

AES-256 encryption at rest
TLS 1.3 and newer in transit
Each organization’s data is isolated from every other organization’s
Mobile data is encrypted on the device

Access and audit

Role-based access for owners, admins, dispatchers, and caregivers
Audit logging on PHI access and EVV changes
Graceful fallback to standard logic when an AI provider is unavailable

Signed

Agreements before any PHI moves.

HIPAA Business Associate Agreement

HIPAA is not a certification or an audit. We design to the HIPAA Security Rule, and a BAA is offered to every senior-care organization for click-through acceptance. AI providers that touch PHI are covered by their own BAAs. We do not send PHI to a provider without one.

No training on your data

Our AI providers are contractually opted out of training on customer data. Your visit notes do not become someone else’s model.

In progress

What we are still building.

We will not describe these as finished until they are.

SOC 2

SOC 2 is in progress. No SOC 2 report has been issued. Ask us for the current status in writing before you rely on it.

Who else touches your data.

Listed at the bottom because most readers won’t get here, but it’s the most important page on this site. Twelve subprocessors, listed below. We notify customers 30 days before adding any subprocessor that handles PHI.

Vendor	Purpose	PHI?	BAA
AWS	Cloud infrastructure, storage, backup	Yes	In progress
DigitalOcean	Production hosting, database and encrypted file storage	Yes	In progress
Anthropic	AI features (dispatch, invoicing, appeals)	Yes	Yes
Sandata	EVV aggregator integration	Yes	In progress
HHAeXchange	EVV aggregator integration	Yes	In progress
Tellus	EVV aggregator integration	Yes	In progress
CareBridge	EVV aggregator integration	Yes	In progress
Stripe	Payment processing	No	N/A
Twilio	SMS / Voice	No	N/A
Resend	Transactional email	No	N/A
Linear	Internal issue tracking (no PHI)	No	N/A
Notion	Internal docs (no PHI)	No	N/A

Send us the security questionnaire you already have.

Your procurement team's questions are welcome. We answer in writing, and we tell you which answers are still in progress.

Send a security question