Are you SOC 2 certified?

SOC 2 Type II is in progress. We are not claiming a completed SOC 2 report.

Do you train models on our data?

No. We do not train, fine-tune, or evaluate EvidenceMD models on your conversations, API prompts, or API outputs.

Yes. Data is encrypted at rest with AES-256-GCM and Azure transparent data encryption, and in transit with TLS 1.2 or higher.

Where is data stored?

Application data is stored on Microsoft Azure in East US 2 (Virginia, United States).

Does the API retain prompts and responses?

No. The EvidenceMD API does not retain prompt or response content after the call. We keep usage metadata only. The clinician product stores chats and scribe notes for you, encrypted at rest, until you delete them.

Will you sign a Business Associate Agreement?

Yes, for eligible plans and for API workloads that involve patient data, after review of the use case. Request access and we will follow up with the agreement.

Who are your subprocessors?

Microsoft Azure (East US 2 hosting and Azure Database), Auth0 (authentication), Google Workspace (business email), GitHub (source code), and Stripe (payments). Meta is not a subprocessor.

Do you use advertising or analytics pixels?

A Meta Pixel runs only on public marketing pages on evidencemd.ai — homepage, product, pricing, blog, and compare. It does not load on authenticated clinician routes, the AI scribe, the patient app, legal pages, or preview and staging hosts. Automatic event scraping is off. Meta does not receive clinical content.

DevelopersTrust Center

API Trust Center

HIPAA compliant clinical reasoning, with zero retention of your data

The EvidenceMD API does not keep your prompts or responses. Traffic is encrypted in transit, data is encrypted at rest on Azure East US 2, and SOC 2 Type II is in progress.

Last updated August 24, 2026.

Compliance

What we state publicly. SOC 2 is in progress, not certified. Policy documents are not published here — request access for the pack.

HIPAA

Compliant

HIPAA compliant. A Business Associate Agreement is available for eligible plans.

SOC 2 Type II

In progress

Audit underway. Not yet certified. Request access for the current timeline.

Encryption at rest

Active

Full database encrypted on Azure. Clinical content additionally encrypted with AES-256-GCM.

Encryption in transit

Active

TLS 1.2 or higher. Plain HTTP is not accepted.

US data residency

Active

Microsoft Azure East US 2 (Virginia). Application data is stored in the United States.

No training on your data

Active

Your conversations and API content are not used to train or fine-tune models.

US data center on Azure

Production compute and the database run in Microsoft Azure East US 2 (Virginia).

Cloud

Microsoft Azure

Azure Container Apps for compute. Same platform for the product and the API.

Region

East US 2

Virginia, United States.

Database

Azure Database

Encrypted at rest. Clinical data additionally encrypted with AES-256-GCM.

Need the full pack?

Policies, BAA, control catalog, and SOC 2 timeline — one request. We do not publish those files on this page.