Skip to main content

Trust & assurance

Security

How we treat risk and data for healthcare revenue teams—clear commitments today and on the roadmap.

Encryption by default

TLS in transit; at-rest patterns built on provider-managed encryption.

No training on your data

Your prompts and documents are not used to train shared foundation models.

Built for regulated work

Access controls and auditing aligned with HIPAA-style expectations under your BAA.

SOC 2 on the roadmap

Independent SOC 2 Type I targeted Q4 FY26; pen tests & access reviews alongside.

Scope

Tahoma processes data you choose to connect: EHR extracts, claims files, correspondence, and conversational context that helps the agent complete tasks. We treat all of it as sensitive, whether or not a field is formally classified as PHI—your policies still govern what may enter the system.

Operating principles

  • 01

    Least privilege, everywhere

    Access to production systems, customer tenants, and support tooling is granted on a need-to-know basis and reviewed on a schedule. Administrative actions leave an auditable trail.

  • 02

    Encryption by default

    Data is encrypted in transit with modern TLS. At rest we rely on provider-managed keys and envelope patterns so ciphertext is the norm—not the exception.

  • 03

    No training on your workloads

    Inputs you send to Tahoma—including prompts, documents, and structured clinical or financial context—are not used to train or fine-tune shared foundation models.

Frameworks & attestation

  • GDPR

    We structure processing relationships, data subject requests, and subprocessors with EU customers in mind. DPA terms are available for enterprise agreements.

  • HIPAA

    Tahoma is designed to sit behind your BAA: administrative safeguards, access controls, and auditability map to the expectations teams already use for PHI workflows.

  • SOC 2 Type I

    We are preparing for an independent SOC 2 Type I examination with a target report window of Q4 FY26, focused on security and availability trust criteria.

How AI uses data

Inference runs in isolated environments. Prompts and retrieved context for your workspace are logically separated from other tenants. We do not sell your data, do not use it to improve public models, and do not allow third-party advertisers into the product path. If we introduce an opt-in program that would ever change that posture, it will be explicit, contractual, and off by default.

Operations

Change management, vulnerability management, and incident response are documented internally and exercised on a cadence. For material incidents affecting your data, we commit to notification aligned with the timelines in your order form or applicable law—whichever is stricter.

Penetration tests and access reviews are part of the same roadmap as the SOC 2 work; we will share executive summaries with customers under NDA as they become available.

Specific commitments, subprocessor lists, and DPA terms appear in your agreement. For security questionnaires or a conversation with our team, contact us.

Last updated June 10, 2026. This page is a summary, not a legal instrument.