Security is our foundation.
We safeguard patient data with defense-in-depth architecture, rigorous compliance, and least-privilege access controls.
HIPAA-Ready
We sign a BAA before any PHI is processed. All PHI is handled in accordance with HIPAA Privacy and Security Rules.
SOC 2-aligned Controls
Built on SOC 2-aligned controls for security, availability, and confidentiality. Formal certification in progress.
Least-Privilege Access
Strict Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), and least-privilege access policies for all employees.
Infrastructure
Cloud Isolation: sycana AI runs on isolated Virtual Private Clouds (VPC). Patient data databases are not accessible from the public internet.
Encryption: All data is encrypted at rest using AES-256. Data in transit is secured via TLS 1.3. Encryption keys are managed via Cloud KMS.
Resilience: Automated daily backups and multi-zone redundancy ensure High Availability (HA) and rapid disaster recovery.
App Security
Audit Logging: Every action (viewing a record, editing a triage score, or downloading a PDF) is immutably logged for compliance review.
SSO Integration: Enterprise plans support SAML 2.0 / OIDC integration with Okta, Azure AD, and Active Directory.
Penetration Testing: We conduct regular third-party penetration tests and static code analysis to identify and patch vulnerabilities.
AI Safety
Data Privacy: Your PHI is never used to train public models. Retention of inference data depends on your configured vendor policies and BAA terms.
Human-in-the-loop: Our "Glass Box" interface ensures every AI suggestion is verifiable. We provide citations linking back to the source document, reducing hallucination risk and supporting verification in clinical settings.
Need our security packet?
Our team can share our SOC 2-aligned control overview, architecture documentation, penetration test summary, and standard BAA. Certification is in progress.