Trust Center

Primary application servers, databases, object storage, and backups for the deployment are located in-region. Administrative records describe regions and change approval; technical deployment pins resources to the regional project.

Public ingress uses modern TLS. Traffic to speech recognition and AI model providers uses TLS to each provider's configured endpoints. This is a technical control verified in architecture reviews and deployment config.

Databases, object storage, and backup objects use industry-standard algorithms (e.g. AES-256-GCM) with keys managed per our cryptography policy. WAL-G backups add client-side encryption before off-site storage.

Layered detection: the hosting platform provides network-layer IDS, while each VM runs fail2ban (SSH brute-force prevention), UFW with default-deny posture, and unattended security upgrades. Authentication and access events from the auth-proxy are shipped to a central Loki/Grafana stack so anomalous login patterns surface in dashboards and alerts. Policies assign triage ownership when alerts fire. Kernel-level runtime IDS for containers is a planned enhancement on top of this baseline.

Clinicians authenticate through a managed identity provider (OIDC/OAuth-style flows); every API path validates identity. Session lifetime and lockout behaviour align with our access-control policy.

Clinician, patient, and admin capabilities are separated in the data model and GraphQL layer so least-privilege is the default. Role definitions and review cadence are documented administratively.

Enterprise deployments enforce MFA at sign-in, through your organisation's identity provider via single sign-on (for example Microsoft Entra ID) or through ours.

Changes flow through source control and scripted, repeatable deploys, with dependencies and container base images pinned to exact versions. Security impact is considered for substantive features as an administrative gate.

Audio is deleted once Hanah has finished transcribing it. Each organisation sets its own retention periods for transcripts and clinical notes, and Hanah deletes them automatically when they expire. Once integrated with your record system, the authoritative clinical record remains yours.

When retention deletes a transcript or note, the record keeps a dated marker showing the content was deleted under the organisation’s retention policy, and deleted content is never sent, synced or redrafted afterwards. Security-sensitive operator actions, such as secret access, account administration and support sessions, are written to dedicated audit tables.

Individuals can request access to or correction of their personal information; Hanah documents timelines, formats (JSON + human-readable exports), and escalation paths. Tooling supports export where data lives in Hanah systems.

We use our speech recognition and AI model providers only on paid commercial terms, which prohibit training on customer content, and requests are sent with provider-side storage switched off wherever the provider offers it. Hanah does not operate an internal training pipeline on your health data. Administrative vendor reviews support the claim.

Hanah drafts, and the clinician reviews and edits every draft. A note is sent to a patient or filed to the practice management system only when the clinician chooses to. This is both a product control and a policy commitment in the PIA.

One harness, two evaluation layers, run on every grading pass: Word Error Rate against verbatim ground-truth transcripts (Layer A), and an LLM jury panel measuring both coverage (does the note capture each pre-registered expectation?) and hallucination (does the note contain claims the transcript does not support — i.e. content the model invented?). The full methodology is published, and live results render directly from the harness's aggregate output. The corpus continues to graduate v1 (synthetic) → v2 (role-play) → v3 (real consent-based) → v4 (joint with health-system partners).

System prompts are server-controlled and inputs are bounded by the clinical workflow (no free-form chat surface). Provider safety classifiers run on every generation; when they trigger, the stream surfaces a content-filter finish reason that is captured in the per-call ai_audit row alongside a canonical ai.content_policy error code, latency, tokens, and a Tempo trace ID. Anomalous patterns surface in dashboards over that audit table. Cross-call behavioural anomaly detection for abuse patterns is a planned enhancement on top of this baseline.

Hanah keeps each patient’s recording consent (yes, no or not yet recorded) and where it came from: the clinician’s answer, or a form, note or practice management record Hanah read it in. Clinics can show it on every visit, so the clinician sees it before recording.

A named executive is accountable for information security; risks are logged with owners and target dates and reviewed on a fixed cadence. This matches what buyers typically expect from an ISO-style management system, even at our current scale.

Formal policies cover access control, cryptography, incident response, vendor management, change management, vulnerability management, and data retention and deletion. They are held under version control; full content is available under NDA.