Security & Compliance
Built for HIPAA. Designed for healthcare.
Every architecture decision was made with HIPAA compliance, clinical audit requirements, and hospital IT security policies in mind — not bolted on after the fact.
BAA available for all paid plans
We sign a HIPAA Business Associate Agreement before you upload your first document. No exceptions.
Security across the full stack
From how data enters the system to how it's stored, accessed, audited, and eventually deleted.
Data Encryption
Encryption at Rest
All documents and patient data encrypted with AES-256.
Encryption in Transit
TLS 1.3 enforced on all connections. No unencrypted data transfer.
Key Management
Encryption keys are managed with automatic rotation.
Access Controls
Role-Based Access
Admin, Clinician, and Viewer roles with least-privilege permissions.
SAML SSO
Integrate with your hospital Active Directory or IdP. No separate passwords to manage.
Session Management
Automatic session expiry, HttpOnly cookies, CSRF protection.
Audit & Compliance
Complete Audit Trails
Every field access, edit, approval, and export is logged with user, timestamp, and IP.
7-Year Retention
Meets CMS requirements for medical record retention. Automated archival and retrieval.
Immutable Logging
All infrastructure API calls logged. Immutable audit log for security investigations.
Infrastructure
HIPAA-Eligible Infrastructure
Hosted exclusively on HIPAA-eligible cloud infrastructure.
VPC Isolation
Processing workloads run in private subnets. No direct internet exposure to compute.
Security Groups
Least-privilege firewall rules. All ingress restricted to API gateway.
How we handle patient data
PHI never trains our models
Your patient data is never used to train or fine-tune AI models. Processing is inference-only. Your data is yours.
US-only data residency
All data stored and processed in the US. No cross-border data transfers.
Minimum necessary principle
Lumenly staff access patient data only when required to resolve a support issue, always with your consent and a logged audit trail.
Retention & deletion
Demo accounts: 30-day auto-delete. Paid accounts: 7-year retention per CMS requirements, then secure deletion with certificate.
Breach notification
Incident response plan with <60-hour notification SLA per HIPAA Breach Notification Rule. Documented procedures reviewed annually.
Start free.
Upgrade when you need it.
The next outage isn't a matter of if. Generate your downtime kit now — no PHI, no credit card, no contract.