Security & HIPAA

Built like a healthcare product, not a chatbot.

We sign BAAs. We encrypt PHI at the column level. We audit-log every AI action. Healthcare data deserves better than the average SaaS.

HIPAA-eligible by default

Every infrastructure provider is HIPAA-eligible and under BAA: Supabase (Postgres), Vercel (compute), Retell (voice), Twilio (SMS), Resend (email), Anthropic (LLM). On Practice and Multi we sign a BAA with you. Solo practices can request one.

PHI encrypted at rest and in flight

Sensitive fields (DOB, notes, full phone, full email) are encrypted at the column level with AES-256-GCM via lib/encryption.ts. Per-business keys are isolated. Database connections are TLS 1.3 only.

Multi-tenant isolation via Postgres RLS

Every tenant table enforces row-level security keyed on business_id. Cross-tenant reads are impossible at the database layer — not just the application layer. Service-role access is restricted to webhooks and Inngest jobs.

Tamper-evident audit log

Every Coach action, voice agent tool call, and admin action writes to audit_log with timestamp, actor, IP, business_id, and before/after diff. Logs are append-only and retained 7 years.

Hosted on US-region infra

All compute, database, and storage in US-East. No data leaves the United States. Vercel + Supabase region-pinned. Retell calls routed via US PoPs. Backups encrypted to S3 us-east-1.

PII never logged in plaintext

Logs use redactPII() before any phone, email, DOB, or SSN is written. Sentry breadcrumbs scrubbed at SDK level. Retell call recordings are PHI-eligible and stored encrypted with auto-expiry.

Policies & specifics

Data retention: Conversation transcripts: 90 days. Recordings: 30 days unless flagged. Audit log: 7 years.
Patient data ownership: You own all data in your Cadence account. Export anytime as JSON or CSV. Coach can do it for you.
Subprocessors: Supabase, Vercel, Retell, Twilio, Resend, Anthropic, Stripe, Inngest, Google. Full list with BAA status on request.
Incident response: We notify customers within 24 hours of any confirmed breach affecting their data, with detailed scope and remediation.
Penetration testing: Annual third-party pentest. Quarterly internal review. Latest report under NDA on request.
Employee access: Engineering access to production is gated by SSO + hardware key + audit log. No raw PHI in dev environments.

Need a SOC 2 report, custom DPA, or BAA on Solo? security@cadenceagents.ai