Trust Center

Live status of every control we run.

Cadence Agents runs healthcare data. We treat security as a product surface — this page is the source of truth for what's active, what's in progress, and what's on the roadmap. Need a SIG, BAA, DPA, or our pentest report? Email security@cadenceagents.ai.

Healthcare compliance

HIPAA Business Associate Agreement
Active
Signed by every infrastructure provider. Customer BAA on Practice + Multi.
SOC 2 Type I
In progress
Vanta-managed. Targeted report Q3 2026. Type II to follow.
PHI inventory + classification
Active
Every column carrying PHI is tagged in lib/types/database.ts and gated through lib/encryption.ts.

Data protection

AES-256-GCM encryption at rest
Active
DOB, clinical notes, OAuth refresh tokens, OD customer keys. Per-business derivation.
TLS 1.3 in transit
Active
Vercel + Supabase + Retell + Twilio + Anthropic. Strict-Transport-Security with preload.
Multi-tenant isolation via Postgres RLS
Active
Every tenant table enforces row-level security keyed on business_id.
Tamper-evident audit log
Active
Every Coach + voice tool call + admin action is append-only logged with diff. 7-year retention.
PII redaction in logs
Active
lib/encryption.ts redactPII() runs on every Sentry payload before it leaves the runtime.

Identity & access

Single sign-on for Cadence engineers
Active
Google Workspace + hardware key. Production access gated and audit-logged.
Magic-link customer auth
Active
Supabase Auth · rate-limited 10/min per IP+email · scrubbed error messages.
OAuth state HMAC
Active
Google Calendar OAuth state is signed (HMAC-SHA256, 10-min TTL) — prevents tenant takeover via state spoofing.
Customer SSO (SAML/OIDC)
Planned
Targeted alongside Multi-Location GA.

Operational security

Continuous secret scanning
Active
GitHub secret scanning + push protection. Pre-commit checks block known token patterns.
Annual third-party penetration test
Active
Last: 2026-Q1. Next: 2026-Q4. Latest report under NDA on request.
Daily Postgres backups + PITR
Active
Supabase Pro · 7-day point-in-time recovery · weekly Stripe export to S3.
Centralised error tracking
Active
Sentry with redactPII gate. No PHI ever reaches Sentry payloads.

Incident response

24-hour breach notification
Active
Customers notified within 24 hours of any confirmed breach affecting their data.
Documented runbook
Active
RUNBOOK.md covers Retell outage, Stripe webhook delay, Inngest backlog, Coach hallucination, RLS misconfig.
Status page
Planned
status.cadenceagents.ai · external monitoring with public uptime — Q3 2026.

Subprocessors

Every vendor that touches customer data, with the data it sees and BAA status. We notify customers 30 days before adding or replacing any subprocessor that handles PHI.

Vendor	Purpose	Region	BAA
Supabase	Postgres, auth	us-east-1	Signed
Vercel	Hosting, edge runtime	us-east-1	Signed
Retell AI	Voice telephony LLM	US	Signed
Twilio	Phone numbers, SMS, WhatsApp	US	Signed
Resend	Transactional email	US	Signed
Anthropic	LLM (Coach + Note + extractor)	US	Signed
Stripe	Payments	US	Signed
Inngest	Durable workflows	US	Signed
Google Cloud	Calendar OAuth	US	Signed
pVerify	Insurance eligibility	US	Signed
Sentry	Error tracking (PII-redacted)	US	Signed
Upstash	Rate-limit cache	us-east-1	N/A · no PHI

Report a vulnerability

We acknowledge within 24h. Coordinated disclosure preferred — we'll work with you on a public thank-you and bounty.

Read the technical security overview

Architecture, encryption details, RLS model, audit log retention.