Yes. Aurus processes protected health information under a signed Business Associate Agreement, with encryption in transit and at rest, role-based access control, and a complete audit trail for every document and every action taken on it. The BAA is executed before any PHI is transmitted — including during a free evaluation.
TLS in transit. Encryption at rest on all stored documents and extracted data. Keys managed separately from the data they protect.
Role-based permissions. Staff see only what their role requires. Every access event is recorded against a named identity.
Every document, every automated decision, every human action — timestamped and attributable. Exportable for your auditors.
Your documents are processed to produce your results. They are not used to train shared models. Your data stays yours.
You set the retention window. When it expires, documents and derived data are purged, and the purge itself is logged.
Low-confidence items route to human review rather than being filed silently. Every automated action can be undone and is logged either way.
We would rather lose a deal on this answer than win one and disappoint you at audit.
| Control | Status | Evidence |
|---|---|---|
| HIPAA Business Associate Agreement | Available | Signed before any PHI transfer |
| Encryption in transit and at rest | In place | Architecture review on request |
| Role-based access control | In place | Demonstrable in product |
| Full audit logging | In place | Exportable trail |
| SOC 2 Type II certification | In progress | SOC 2 aligned controls operating; report date published on completion |
| Penetration test | Scheduled | Summary shared with customers under NDA |
We will not claim a certification we do not hold. If a control matters to your procurement process and is not listed here, ask — we will give you a straight answer and a date.
Yes, and we sign it before any protected health information is transmitted — including during a free evaluation. No PHI moves without an executed BAA in place.
Aurus operates SOC 2 aligned controls covering access management, change management, encryption and audit logging. Formal certification is in progress. We will publish the report date when the audit completes rather than implying certification we do not yet hold.
No. Customer documents are processed to produce your results and are not used to train shared models.
In US-based infrastructure. If you have a specific residency requirement, raise it during evaluation and we will tell you plainly whether we can meet it.
You export it, we purge it, and the purge is logged. No hostage-taking, no retention of your documents past your instruction.
Executed agreement first, documents second, results in one business day. That order never changes.
Card required to start · No migration · Answer in one business day