Yes. Aurus processes protected health information under a signed Business Associate Agreement, with encryption in transit and at rest, role-based access control, and a complete audit trail for every document and every action taken on it. The BAA is executed before any PHI is transmitted — including during a free evaluation.
TLS in transit. Encryption at rest on all stored documents and extracted data. Keys managed separately from the data they protect.
Role-based permissions. Staff see only what their role requires. Every access event is recorded against a named identity.
Every document, every automated decision, every human action — timestamped and attributable. Exportable for your auditors.
Your documents are processed to produce your results. They are not used to train shared models. Your data stays yours.
You set the retention window. When it expires, documents and derived data are purged, and the purge itself is logged.
Low-confidence items route to human review rather than being filed silently. Every automated action can be undone and is logged either way.
We would rather lose a deal on this answer than win one and disappoint you at audit.
| Control | Status | Evidence |
|---|---|---|
| HIPAA Business Associate Agreement | Available | Signed before any PHI transfer |
| Encryption in transit and at rest | In place | Architecture review on request |
| Role-based access control | In place | Demonstrable in product |
| Full audit logging | In place | Exportable trail |
| SOC 2 Type II | Compliant | Controls in operation; details under NDA |
| Penetration test | Scheduled | Summary shared with customers under NDA |
We say compliant, not certified, and mean exactly that. If a control matters to your procurement process and is not listed here, ask — we will give you a straight answer and a date.
Yes, and we sign it before any protected health information is transmitted — including during a free evaluation. No PHI moves without an executed BAA in place.
Yes. Aurus is SOC 2 Type II compliant: controls covering access management, change management, encryption and audit logging are in operation. We describe this as compliance, not certification.
No. Customer documents are processed to produce your results and are not used to train shared models.
In US-based infrastructure. If you have a specific residency requirement, raise it during evaluation and we will tell you plainly whether we can meet it.
You export it, we purge it, and the purge is logged. No hostage-taking, no retention of your documents past your instruction.
Executed agreement first, documents second, results in one business day. That order never changes.
7-day free trial · Card required before the trial ends · No migration