Trust and security

How we handle data and security.

Procurement and security teams need straight answers before any clinical AI work starts. This page lists only the arrangements we actually support, and how to get our documentation for your review.

Request security documentation

US regulation and standards

Frameworks we work within, not certifications we hold.

HIPAA
HITECH
ONC HTI-1
NIST AI RMF
FDA SaMD
FHIR

Where the work happens

By default we work inside your own systems or your own cloud tenant, so your data stays where it already is and under your controls.

Verilian-managed hosting is available if you would rather not host the work yourself. All client data is hosted in the US. State-specific hosting is available on request where the provider supports it.

Verilian-managed hosting

Only the arrangements listed here are in place. We do not use any other provider to process client data.

Access: Only the assigned Executive Analyst on the engagement can access client data. Access is granted per project and removed when the project closes.
Hosting location: Client data is hosted on Google Cloud Platform (us-east4, Northern Virginia) and Microsoft Azure (East US, Virginia).
Approved providers: Google Cloud Platform (including Vertex AI) and Microsoft Azure (including Azure OpenAI). No other provider processes client data.

Patient data (PHI)

Verilian has Business Associate Agreements in place with Google Cloud and Microsoft Azure and uses only services covered by those agreements for client data.

Patient data is handled only where a BAA covers every system involved. Otherwise the workflow runs client-hosted.

Retention, deletion and logging

Retention: Client data is kept only for the length of the engagement plus 30 days, unless the contract says otherwise.
Deletion: Client data is deleted within 30 days of contract end, or sooner on written request, and the client receives a written deletion confirmation.
Logging: We log access to client data and system activity, and keep these logs for 12 months for security and audit purposes. Logs do not contain patient information.

Review before data moves

No client data enters Verilian systems until all three are true:

1: The scope and data list are agreed in writing.
2: Required agreements, including a BAA, are signed.
3: The client approves exactly which data will be used and who can access it.

Need something this page does not cover? Ask our team directly.

Do not send patient information through this website.

Regulation

The US frameworks we work within.

We account for these in how we scope, build and govern every engagement. Frameworks we work within, not certifications we hold.

HIPAAPrivacy and Security Rules: how protected health information may be used, disclosed and safeguarded, and the minimum necessary standard
HITECHBreach notification and the obligations of business associates
ONC HTI-1Transparency rules for predictive decision support in certified health IT
NIST AI RMFA voluntary framework for identifying and managing AI risk
FDA SaMDWhen clinical software is regulated as a medical device, and how it may change
FHIRThe interoperability standard we build integrations on where the EHR supports it

Request security documentation.

Tell us what your review needs and we will reply personally within one business day. Please do not send patient information through the website.

Request security documentation Read the privacy notice (draft)