Security and privacy built for clinical-grade data

Distillemr's Security and Privacy team establishes policies and controls, monitors compliance continuously, and works with independent auditors to maintain HIPAA and SOC 2 Type II compliance. We process protected health information (PHI) to power automated chart review and clinician performance analytics, so protecting that data is foundational to the product.

Visit our Trust Center

Our policy principles

We apply a least-privilege philosophy, defense-in-depth controls, and continuous monitoring to protect PHI and customer data.

01

Distillemr is committed to protecting the security, confidentiality, integrity, and availability of its information resources.

02

Data access is granted only to individuals who meet a least-privilege, minimal-access standard.

03

We implement strong, layered security controls according to the principle of defense in depth.

04

Controls are applied consistently across systems, monitored continuously, and improved iteratively to increase effectiveness and auditability.

Ensuring diligent data protection

Encryption at rest

Customer data and PHI are encrypted at rest using AES-256 with managed key controls.

Encryption in transit

Data in transit is encrypted using TLS 1.2 or higher.

Least-privilege access

Access is restricted by role and need-to-know, aligned to minimal-access principles.

Auditability

Logging and monitoring ensure access, changes, and security events are observable and reviewable.

Taking product security seriously

  • Hosted on AWS. We run on Amazon Web Services' HIPAA-eligible cloud under a signed BAA for top-tier security and reliability.
  • Continuous monitoring with Vanta. We use Vanta to continuously monitor controls and scan for vulnerabilities in real time.
  • Annual penetration testing. We conduct penetration testing at least once a year through an independent third party and track findings to remediation.

Responsible AI data handling

Distillemr uses large language models to review charts and generate analytics, and we treat that data path as a first-class security boundary.

  • No training on your data. Customer data and PHI are never used to train foundation models.
  • No retention. Model providers in our PHI path do not retain prompts or outputs after a request completes.
  • BAAs in place. Every model provider that processes PHI operates under a signed Business Associate Agreement.

Security is operational, not aspirational

  • Security training. The Distillemr team completes security and HIPAA training at onboarding and annually thereafter.
  • Managed access and devices. Workforce access runs through Google Workspace single sign-on with MFA, and company devices are centrally managed with Jamf, enforcing disk encryption and screen lock.
  • Vendor and subprocessor review. Third parties are assessed before they touch customer data, and every subprocessor that processes PHI operates under a signed BAA.

Security FAQ

Yes. Distillemr is built for healthcare data and operates under HIPAA-aligned administrative, technical, and physical safeguards. We sign BAAs with covered entities and partners.

Yes. Distillemr maintains a SOC 2 Type II attestation. We share the report under NDA as part of a standard security review.

Customer data and PHI are encrypted at rest with AES-256 and in transit with TLS 1.2 or higher, with layered controls across the data lifecycle.

No. Customer data and PHI are never used to train foundation models, and providers in our PHI path do not retain prompts or outputs after a request completes. All model providers that process PHI operate under signed BAAs.

Access is restricted to authorized personnel with a legitimate business need under a least-privilege model. Access is logged and reviewed.

Yes. We engage an independent third party at least annually and track findings to remediation.

Yes. Our Security and Privacy team supports security reviews, questionnaires, and documentation requests during procurement and onboarding.

Have security questions?

We support security reviews, vendor questionnaires, and SOC 2 report requests.

security@distillemr.com