Scope
Tahoma processes data you choose to connect: EHR extracts, claims files, correspondence, and conversational context that helps the agent complete tasks. We treat all of it as sensitive, whether or not a field is formally classified as PHI—your policies still govern what may enter the system.
Operating principles
- 01
Least privilege, everywhere
Access to production systems, customer tenants, and support tooling is granted on a need-to-know basis and reviewed on a schedule. Administrative actions leave an auditable trail.
- 02
Encryption by default
Data is encrypted in transit with modern TLS. At rest we rely on provider-managed keys and envelope patterns so ciphertext is the norm—not the exception.
- 03
No training on your workloads
Inputs you send to Tahoma—including prompts, documents, and structured clinical or financial context—are not used to train or fine-tune shared foundation models.
Frameworks & attestation
GDPR
We structure processing relationships, data subject requests, and subprocessors with EU customers in mind. DPA terms are available for enterprise agreements.
HIPAA
Tahoma is designed to sit behind your BAA: administrative safeguards, access controls, and auditability map to the expectations teams already use for PHI workflows.
SOC 2 Type I
We are preparing for an independent SOC 2 Type I examination with a target report window of Q4 FY26, focused on security and availability trust criteria.
How AI uses data
Inference runs in isolated environments. Prompts and retrieved context for your workspace are logically separated from other tenants. We do not sell your data, do not use it to improve public models, and do not allow third-party advertisers into the product path. If we introduce an opt-in program that would ever change that posture, it will be explicit, contractual, and off by default.
Operations
Change management, vulnerability management, and incident response are documented internally and exercised on a cadence. For material incidents affecting your data, we commit to notification aligned with the timelines in your order form or applicable law—whichever is stricter.
Penetration tests and access reviews are part of the same roadmap as the SOC 2 work; we will share executive summaries with customers under NDA as they become available.