Your patients trust you with their health. You can trust us with their data. HIPAA-compliant infrastructure, end-to-end encryption, and continuous monitoring.
Zero
Data Breaches
Q1 2026
Last Security Audit
Health Insurance Portability and Accountability Act compliant with signed BAAs
SOC 2 audit in progress. All data hosted on SOC 2 Type II certified infrastructure (GCP)
General Data Protection Regulation compliant for EU data subjects
California Consumer Privacy Act compliant
Enterprise security protecting your practice and patients at every level
All patient data is encrypted using AES-256 encryption at rest and TLS 1.3 in transit. Client-side encryption ensures only you can decrypt sensitive PHI.
Full compliance with HIPAA Security Rule and Privacy Rule. We sign Business Associate Agreements (BAA) and maintain comprehensive audit trails.
Data stored in HIPAA-compliant data centers in the United States, hosted on SOC 2 Type II certified infrastructure (GCP), with automatic backups and disaster recovery.
We can't access your unencrypted patient data. Decryption keys are generated on your device and never transmitted to our servers.
Complete audit logging of all data access and modifications. Immutable logs stored securely for compliance and forensic analysis.
Annual penetration testing, quarterly vulnerability assessments, and continuous security monitoring by third-party experts.
Data Handling
Transparent data practices with patient privacy at the core
Documentation
Download our compliance documents and review our policies
Security FAQ
Answers to frequently asked security and compliance questions
Yes. Scribeable is fully HIPAA compliant. We implement all required administrative, physical, and technical safeguards. We sign Business Associate Agreements (BAA) with all covered entities at no additional cost.
All data is stored in the United States on Google Cloud Platform (GCP) infrastructure, which is SOC 2 Type II certified. All data is encrypted at rest and in transit.
No. We use zero-knowledge architecture. Decryption keys are generated on your device and never transmitted to our servers. Even our employees cannot access your unencrypted patient data.
We have comprehensive incident response procedures including immediate containment, forensic analysis, and affected party notification within 24 hours as required by HIPAA. To date, we have had zero data breaches.
Absolutely not. Your patient data is never used to train AI models. Our AI models are pre-trained and your data is processed only for generating your clinical notes.
You control your data retention. Notes and recordings can be deleted at any time from your account. Upon account deletion, all data is permanently removed within 30 days.