At a glance
- Data is encrypted in transit.
- Sign-in with passkeys, two-factor authentication, and your organization's single sign-on.
- Access by role, set by each organization's owners and admins.
- A record of what staff and AI agents do.
- Health records kept in FHIR R4, the open healthcare data standard.
- We do not train AI models on customer data.
Protecting data
- In transit. Our products are served over HTTPS.
- Credentials. Passwords and API keys are stored only as irreversible hashes. Sign-in sessions and the credentials organizations give us to reach other systems are encrypted.
- Separation. Each organization's data is kept apart, and every request is checked against the organization it belongs to.
- Keeping less. Clinical records stay in the organization's own record. We don't keep voice recordings, and short-lived data is deleted automatically. See our data policy.
Access control
- Owners and admins decide who in their organization has access, and with what role.
- Two-factor authentication is available to every account, and organizations can require sign-in through their own identity provider.
- Developer API keys are scoped to what they may do, can expire, can be revoked at any time, and are rate-limited.
Audit trail
- Each organization can see who did what in its workspace, whether a member of staff or an automated agent.
- Every decision an AI agent makes records the approval rule that applied. Changes to those rules are recorded with who made them.
- Developer activity is logged without the content of requests or responses.
AI safeguards
- Organizations set which actions an agent may do on its own, which need the patient's confirmation, and which need staff approval. Anything those rules don't cover goes to staff.
- Third-party AI providers process data only where the organization has allowed them. They are listed on our subprocessors page.
- Agents are tested before we rely on them.
More on our responsible AI page.
Hosting and providers
The cloud provider and region that host an organization's data are named in its agreement. The other companies that process data for us are on our subprocessors page.
Incident response
- We contain the incident and keep the evidence.
- We tell affected organizations without undue delay, and within 48 hours of becoming aware of a personal data breach that affects their data.
- Where we are the controller, we notify the Nigeria Data Protection Commission within 72 hours, and tell the people affected when the risk to them is high.
- We fix the cause and share what we changed.
Certifications
We don't claim any certification we don't hold. We answer security questionnaires and support due diligence reviews: write to [email protected].
Report a vulnerability
If you find a security weakness in any Boolbyte product, email [email protected] with the details and how to reproduce it. Please give us reasonable time to fix it before you share it, and don't access, change, or keep anyone else's data while testing. We will acknowledge your report and keep you informed.