Security and HIPAA

Security and HIPAA

Your data stays yours. We read what you authorize, show what your team needs, and sign a BAA before any patient data is involved.

Most of our clients are healthcare and admissions teams, so we build every dashboard assuming the data matters. Here is how we handle it: where the data lives, who owns it, how access works, and how HIPAA is covered.

BAA
Signed before any PHI
Client-owned
Data and servers
Daily
Backups and recovery
Encrypted
Credentials and keys
Your data

Where your data lives, and who owns it

Read from your systems

Many dashboards read your data live, or on a schedule, straight from your systems through their APIs. Nothing is stored in between.

Or kept on a server you own

When a dashboard needs history, we set up a cloud server in your name. You own the server and the data on it; we have access to run the dashboard.

Deleted when you ask

Because the data and the server are yours, it can be deleted at any time, and access can be removed at any time.

HIPAA

HIPAA and Business Associate Agreements

BAA first

For healthcare clients we sign a Business Associate Agreement before any protected health information is processed. The BAA sets out how PHI is handled.

Minimum necessary

We access only the fields you authorize. Dashboards can show counts and rollups only, with patient names and details left in your own systems.

Your phone system’s BAA

Voicemail transcripts and AI summaries are produced by your own phone system, such as CallTrackingMetrics, under its own BAA with you.

Breach notification

If a breach ever affects your data, we notify you within the time the law requires, as set out in your BAA.

Access

How access is protected

Every dashboard requires a login

Dashboards are not public. Each one sits behind a login on its own subdomain.

Credentials stay encrypted

API keys, tokens, and passwords for your systems are stored encrypted and are never sent to the browser.

HTTPS everywhere

Every dashboard and every connection to your systems runs over encrypted HTTPS.

Least privilege

We ask for the narrowest access each integration needs, and you can revoke it at any time.

Reliability

Backups, recovery, and monitoring

Daily backups

Stored dashboard data is backed up daily, with disaster recovery in place.

Monitored

We watch the connections to your systems and fix them when an upstream API changes.

Your export

If you leave, you get a reasonable export of your aggregated dashboard data.

FAQ

Common questions

Yes. For healthcare clients we sign a Business Associate Agreement before any protected health information is processed.
Related dashboards

You might also want

Get a quote

Tell us your systems. Get a fixed quote in 48 hours.

We ask what you use, what nobody can answer today, and who needs to see the data. We come back with a fixed scope and quote within two business days of our discovery.

We will not add you to a drip list. Promise.