Trust

Security & compliance

Sonnata processes patient information for hospital revenue cycle teams. Security and compliance aren't features — they're the foundation. Here's how we operate.

Last reviewed: January 1, 2026
One-line summary. SOC 2 Type II, HITRUST r2 in progress, HIPAA Business Associate under signed BAAs, AES-256 at rest and TLS 1.2+ in transit, single-tenant isolation, MFA everywhere, and a documented incident-response program with named on-call owners.

1. Certifications & attestations

  • SOC 2 Type II — audited annually by an independent CPA firm against the Security, Availability, and Confidentiality Trust Services Criteria.
  • HITRUST r2 — certification in progress; controls aligned to the HITRUST CSF.
  • HIPAA — operating as a HIPAA Business Associate under signed BAAs with every customer that transmits PHI to the platform.
  • Hosting — infrastructure hosted in HIPAA-eligible regions of major U.S. cloud providers, which themselves carry SOC 1/2/3, ISO 27001/27017/27018, FedRAMP, and HITRUST.

2. HIPAA & PHI handling

We treat PHI as the most sensitive data class in our system. Operational commitments:

  • PHI is processed only under a signed BAA and only for the purposes permitted by that BAA.
  • Minimum-necessary access — engineers do not have routine access to production PHI; break-glass access is logged, justified, and reviewed.
  • No PHI in non-production environments. Sample data is synthetic.
  • No PHI used to train generative or foundation models for use outside the customer's tenant.
  • Breach notification consistent with 45 CFR § 164.410 and our BAA terms.

3. Architecture & isolation

Each hospital customer's data lives in a logically isolated tenant, enforced at the database, application, and identity layers. We also offer single-tenant deployment options for customers with elevated isolation requirements. Production workloads run in private subnets, egress-restricted, and reachable only through audited service boundaries.

4. Encryption

  • At rest: AES-256 for databases, object stores, and backups. Keys managed in a hardware-backed KMS with automatic rotation.
  • In transit: TLS 1.2 or higher for all external traffic; TLS or mTLS for internal service-to-service traffic.
  • Field-level: sensitive identifiers are additionally encrypted at the field level with envelope encryption.

5. Access control

Single sign-on with mandatory MFA for all employee access to internal and production systems. Role-based access control with least-privilege defaults. Quarterly access reviews. Customer-side: SAML/OIDC SSO available, with SCIM provisioning on enterprise plans.

6. Logging & monitoring

All authentication events, administrative actions, and access to PHI are logged to an immutable, time-stamped audit log. Logs are retained for a minimum of one year and monitored in real time by a security information and event management (SIEM) platform. Anomalies route to a 24/7 on-call security responder.

7. Testing & vulnerability management

  • Static and dynamic application security testing in CI.
  • Software composition analysis with automated dependency alerts.
  • Continuous vulnerability scanning of infrastructure and container images.
  • Independent third-party penetration test, at minimum annually; remediation tracked to closure.
  • Coordinated disclosure: security@sonnata.ai.

8. Incident response

We maintain a documented Incident Response Plan with defined severity levels, named on-call owners, customer-communication SLAs, and post-incident review. We exercise the plan at least annually in a tabletop format. For incidents affecting customer PHI, our notification commitments meet or exceed the requirements of HIPAA and the relevant BAA.

9. AI governance

Sonnata's multi-agent platform is governed by an internal AI policy that covers model selection, evaluation, monitoring, and human oversight. Specifically:

  • No customer PHI is used to train or fine-tune third-party foundation models.
  • Patient-facing agents operate inside guardrails reviewed by our clinical and compliance leads.
  • Outputs that affect patient communication are logged for traceability and reviewable by the hospital.
  • Customers can disable or restrict specific agent capabilities at the tenant level.

10. Vendor management

We maintain a vendor risk-management program that classifies vendors by data sensitivity and reviews them on a defined cadence. Subprocessors that touch PHI sign BAAs. A current subprocessor list is available on request.

11. Business continuity & disaster recovery

Production data is backed up continuously with point-in-time recovery and replicated across multiple availability zones. Our documented Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are tested at least annually.

12. Requesting reports

Under NDA, we share SOC 2 reports, pen test letters, our latest HIPAA risk assessment summary, security questionnaires, and our subprocessor list. Email security@sonnata.ai and include your role, organization, and a brief description of what you need.

Note. This page is a customer-facing summary of our security posture. It is not a complete description of every control in our security program. The authoritative source for any customer is the contract and BAA we execute together.