PHI, BAA, and data handling
Where protected health information is permitted, how payloads are encrypted and isolated, retention by plan, and what is audited.
Last updated August 12, 2026
On this page
This page states how the platform handles clinical data today. Where something is in progress rather than finished, it says so.
Where PHI is permitted
Protected health information is permitted on the Team and Enterprise plans, and only under a signed Business Associate Agreement.
The Free plan is restricted to synthetic data. It exists so you can design, import and test without a contract — not so you can pilot with live patient records.
We describe the platform as HIPAA-ready: the technical and organizational controls expected of a business associate are in place, and the BAA is what puts them under contract. There is no such thing as a HIPAA certification, and we do not claim one.
SOC 2
Our SOC 2 program is in progress — evidence collection is under way and a Type 1 assessment is scheduled. There is no badge on this site because there is not yet a report behind it. If your procurement process needs the current status in writing, ask us.
Encryption
- Message payloads and bundles are encrypted at rest in S3 using KMS-managed keys.
- TLS 1.2 or higher on every connection in transit; mutual TLS is available where a counterparty requires it.
- Ephemeral storage attached to running channel tasks is encrypted.
- Secret references are resolved at runtime and never rendered into logs or traces.
Isolation
- There is no shared filesystem between tenants.
- Each paid channel runs in its own dedicated task rather than a shared worker.
- Platform operators cannot read PHI payloads or message traces.
- Sandbox environments are ephemeral and are torn down after their idle timeout.
Access and audit
- Single sign-on with Google and Microsoft on Team; OIDC and SAML on Enterprise.
- Workspace roles:
owner,admin,editor,viewer. - Organization membership with invitations and revocation.
- Audit logs on all mutating APIs — who changed what, and when.
Retention
| Plan | Message retention |
|---|---|
| Free | 7 days |
| Team | 30 days |
| Enterprise | 365 days |
Extended retention is available as an add-on on paid plans.
Network controls
Production listeners require an inbound allowlist. Dedicated ingress and egress address sets give counterparties a stable IP to allowlist on their side. Gateway addresses under *.gw.intucloud.ai terminate TLS 1.2 or higher. The platform is hosted in AWS us-east-1 during the beta.
Keeping PHI out of support tickets
Do not paste message payloads into support requests. Reference message IDs, channel names and timestamps instead — that is enough for us to find what you are looking at. See the support page.
If data cannot leave your network
Run the open-source engine yourself. The data never reaches us, and a paid enterprise support subscription keeps our engineers available.