CredOps AI runs on HIPAA-eligible cloud infrastructure. We minimize what we store, encrypt what we keep, and make our practices legible — so your compliance officer can sign off without a forty-page questionnaire.
The security foundation is in production from the first signup — not deferred to a later milestone.
A simple data-flow diagram a compliance officer can sign off on — the same controls applied at every layer.
The cheapest way to be HIPAA-compliant is to not handle PHI. We took that principle seriously from the architecture stage.
When you ask AI to read a license, the document moves through a path designed to be both useful and accountable.
We don't run a paid bounty yet, but we acknowledge every report within one business day, fix critical issues within seven, and credit researchers publicly (with your permission).
If yours isn't here, write to security@credops.ai — we answer in plain English, with citations.
We have not yet completed third-party security certifications under the CredOps brand. The cloud infrastructure we run on is itself HIPAA-eligible and independently audited — we can share those reports under NDA as part of our security packet. We will pursue our own formal certifications once we have the customer base to make the audit meaningful, and we'll publish the timeline here when it's scheduled.
No — they are two separate agreements. Our cloud provider gives us a BAA covering the infrastructure (HIPAA-eligible services). We give you a BAA covering CredOps as a business associate of your practice. Both are required for HIPAA coverage of the data chain.
All customer data is hosted in the United States, in a primary region with disaster-recovery replication to a second US region. All data is encrypted at rest with managed keys. We do not currently offer EU or Canadian data residency — reach out if that's a requirement.
You can export everything as CSV plus original document files at any time. On cancellation, your data is retained in a frozen state for 30 days (in case you change your mind), then hard-deleted — including from backups within 90 days. We send written confirmation when deletion completes.
SSO with Google Workspace and Microsoft Entra is available on the Group tier. SCIM provisioning is not yet available; it's on the roadmap for late 2026.
Only the office-manager accounts you've explicitly invited. Internal access is limited to a small, named engineering group, requires SSO with MFA, and every action is captured in the immutable audit log. We never read your documents to "improve the product" — the AI pipeline runs without human-in-the-loop on your tenant.
A documented incident response plan kicks in. We assess scope within 4 hours, notify affected customers within 24 hours, and publish a public postmortem within 7 days. For HIPAA-reportable breaches we follow the 60-day HHS notification requirement.
Yes — we maintain pre-filled responses for the CAQ, SIG Lite, and the OCR HIPAA Audit Protocol. We can sign custom DPAs for any paid tier. Email legal@credops.ai with what you need.