SecurityFeatures
Scribara/Security

Built for clinical data from the first commit.

Scribara handles PHI. That fact shapes the architecture, the team, the audit posture, and the contracts. Nothing about our security program is bolted on.

Compliance

Certifications & frameworks.

SOC 2

Type II audited

Continuous controls — Drata-monitored. Report available under NDA.

HIPAA

BAA on day one

End-to-end PHI handling. De-identification at ingress. Auditable retention.

42001

ISO/IEC 42001

AI management system certified — the only standard built for clinical AI.

27001

ISO/IEC 27001

Information security management. Certified annually.

HITRUST

HITRUST CSF r2

Healthcare-aligned controls. Validated assessment in flight.

GDPR

GDPR + EU AI Act

EU residency on Enterprise. AI Act conformity declared.

PCI

PCI-DSS

Card data handled by Stripe; Scribara never touches a PAN.

CSA

CSA STAR

Cloud Security Alliance self-assessment published.

Architecture

How your data is protected.

Scribara treats every customer as a regulated tenant. Data never crosses tenant boundaries — at compute, storage, or model layers.

Tenant isolation

Schema-per-tenant on Practice. Cluster-per-tenant on Enterprise. Per-tenant KMS keys with annual rotation.

Encryption

TLS 1.3 in transit. AES-256-GCM at rest. CMK/BYOK supported on Enterprise. Field-level encryption for direct identifiers.

PII redaction at ingress

Microsoft Presidio plus custom clinical NER. Direct identifiers stripped before retrieval & model inference.

Prompt-injection defense

Input sanitization. Tool-call allowlists. Output validators. No tool runs without policy match.

No training on PHI

Customer data never trains shared models. Opt-in de-identified contributions only, with contractual carve-outs.

Audit log

Immutable, append-only. Every agent step, tool call, signature. SIEM export to Splunk, Datadog, Sumo.

Identity

Authentication & access control.

WorkOS-powered SSO, fine-grained RBAC, and per-action policies that line up with your compliance officer's requirements — not the model's preferences.

SAML / OIDC

Okta, Azure AD, Google Workspace, Duo, Ping.

SCIM provisioning

Automatic on/off-boarding from your IdP.

RBAC + ABAC

Per-role, per-location, per-action permissions.

MFA enforced

TOTP, WebAuthn, or hardware key required.

Operations

How we operate.

The team behind the security posture, the cadence of testing, and the people you'll talk to during a procurement review.

Pen-test annually

Third-party penetration test annually + after major architectural changes. Bug bounty via HackerOne.

Production-shadow evals

Every model version runs in shadow against live traffic before promotion. Regressions blocked at CI.

Incident response

24×7 on-call. 1-hour customer notification SLA on confirmed PHI incidents. Public post-mortems.

Data residency

US-East, US-West, EU-West. Customer-pinned. Cross-region replication opt-in only.

Procurement & security review

Skip the back-and-forth.

Request our trust packet: SOC 2 Type II report, HIPAA BAA, DPA, pen-test summary, architecture diagram, and AI model card.