Trust Center
Security, privacy, and compliance at EvidenceMD
HIPAA compliant clinical AI, hosted on Microsoft Azure in the United States. The database is encrypted at rest. SOC 2 Type II is in progress. Detailed policies are available on request.
Last updated August 22, 2026.
Compliance
What we state publicly. SOC 2 is in progress, not certified. Policy documents are not published here — request access for the pack.
HIPAA
CompliantHIPAA compliant. A Business Associate Agreement is available for eligible plans.
SOC 2 Type II
In progressAudit underway. Not yet certified. Request access for the current timeline.
Encryption at rest
ActiveFull database encrypted on Azure. Clinical content additionally encrypted with AES-256-GCM.
Encryption in transit
ActiveTLS 1.2 or higher. Plain HTTP is not accepted.
US data residency
ActiveMicrosoft Azure East US 2 (Virginia). Application data is stored in the United States.
No training on your data
ActiveYour conversations and API content are not used to train or fine-tune models.
US data center on Azure
Production compute and the database run in Microsoft Azure East US 2 (Virginia).
Cloud
Microsoft Azure
Azure Container Apps for compute. Same platform for the product and the API.
Region
East US 2
Virginia, United States.
Database
Azure Database
Encrypted at rest. Clinical data additionally encrypted with AES-256-GCM.
Need the full pack?
Policies, BAA, control catalog, and SOC 2 timeline — one request. We do not publish those files on this page.