Snapshot 240870
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Monitored and Powered by Trust Center www.confident-ai.com Compliance overview Current compliance status across frameworks GDPR Compliant SOC 2 Type 2 Compliant HIPAA Compliant Featured documents Key security and compliance documentation Confident AI Inc. SOC2 Type 1 Service Auditor Report Request access Confident AI - HIPAA Assessment Request access Confident AI SOC 2 Type 2 Report - 2026 Request access View all documents Compliance Program An overview of security controls in place Access Control and Authorization Access management policy established Access requests to sensitive data required Access requests to sensitive infrastructure required Access revoking process enforced Account inventory maintained Automated decision-making and profiling has oversight Automatic user logoff enforced Changes to PHI logged Emergency access procedure established Employee access regularly reviewed MFA required for applications MFA required for critical services Password management policy enforced Password management policy established Unique user identification implemented Data Management and Protection Confidential customer communication channel created Consent for collecting and managing data obtained Criminal record data processing managed Cryptographic keys and application secrets secured Data encrypted at rest Data encrypted in-transit Data inventory maintained Data management and retention policy established Data processing integrity and output validated Data transfer mechanisms established External privacy inquiries managed PHI access and amendment requests managed PHI disclosure records maintained Privacy disclosure and notification mechanisms established Privacy policy created and maintained Secure disposal process established Use and disclosure of PHI managed Disaster Recovery Automated backups enabled Business continuity and disaster recovery policy established Data backup and recovery policy established Data recovery process established Data recovery tested Disaster recovery plans documented Recovery data isolated Email Security DMARC policy and verification used Email account access restricted Email settings block malicious content Endpoint Security Anti-malware deployed on end-user devices Automatic session locking enforced Data encrypted on end-user devices Firewall maintained on end-user devices Mobile device management (MDM) used Infrastructure Security Active discovery tools used Administrator access restricted Automated security scanning performed on infrastructure Buckets not exposed publicly Configuration management system established Infrastructure changes logged Infrastructure deployed using an infrastructure-as-code tool Network infrastructure continuously updated Production deployment access restricted Unique production database authentication enforced Web Application Firewall (WAF) used Monitoring and Incident Response Adequate audit log storage maintained Audit log management process maintained Audit logs collected Breach notification process established Breach notification template prepared Breach response playbook established Incident response exercises performed Incident response policy established Incident response procedures defined Infrastructure performance monitored Log management used Network infrastructure monitored Organizational Security Acceptable use policy established Asset inventory maintained Asset management policy established Board charter documented Business associate agreements managed Business associate agreements with subcontractors managed Change management policy established Code of conduct established Confidentiality Agreement acknowledged by contractors Confidentiality Agreement acknowledged by employees External support resources available (i.e., documentation) HIPAA training conducted Human resource security policy established Information security program established Internal privacy policies established Internal security audit performed Operational procedures maintained Password manager used Physical access restricted Physical security policy established Policy for compelled disclosure from law enforcement established Relevant authorities identified Roles and responsibilities specified Scope for compliance framework established Security Violations Managed Security awareness training conducted Security official assigned Service description communicated Software development lifecycle established Third-party security oversight conducted Vendor agreements established Whistleblower policy established Workstation use and security policy established Risk Management Data Protection Impact Assessment (DPIA) completed Risk assessments performed Risk management policy established Vendor inventory maintained Vendor management program established Vulnerability Management Penetration testing findings remediated Penetration testing performed within the last 12 months Vulnerabilities remediated Vulnerability management policy established