Security

Infrastructure

The Automate Admits application, database, and storage — including all protected health information (PHI) — run on Amazon Web Services under a signed business associate agreement. The application runs on ECS Fargate; the database is Amazon RDS for PostgreSQL in a private subnet with no public network access; files, call recordings, and backups are stored in Amazon S3.

Our public marketing site is delivered through Cloudflare for DNS, CDN, and DDoS protection; no PHI is stored on or processed by Cloudflare. Each customer organization's data is logically isolated within our multi-tenant database and scoped to that organization on every request. We run an automated tenant-isolation audit over the codebase as part of every release: any database query that touches customer data and is not scoped to an organization fails the build until it is explicitly reviewed.

Encryption

• In transit. All traffic to and from the Service is served over HTTPS/TLS, with HTTP Strict Transport Security set to one year. Requests over plain HTTP are redirected to HTTPS. Database connections require TLS — the server refuses unencrypted connections. Our S3 buckets deny any request that does not arrive over TLS. Communication with every third-party service we rely on takes place over encrypted connections.
• At rest. The database, object storage, and backups are encrypted with an AWS KMS customer-managed key with automatic key rotation enabled. S3 buckets additionally have public access blocked and object versioning enabled.
• Query logging is off. The database is configured not to log statement text, so PHI passed as query parameters does not land in log files.

Authentication & access control

• Passwords are never stored in plain text. They are stored only as a PBKDF2-SHA256 hash with a per-user random salt and 100,000 iterations, so the original password cannot be recovered from our records.
• Two-factor authentication is available to every user using a standard TOTP authenticator app, with single-use recovery codes for account recovery. Organization owners can require it.
• Brute-force protection. Failed sign-in attempts are recorded and an account is temporarily locked after repeated failures.
• Role-based access. The Service has five roles with distinct permissions, so teammates only get the access their job requires.
• Sessions use a signed, HTTP-only, secure session cookie and expire. We do not use advertising cookies.
• Channel tokens used to send and receive on a connected Facebook Page or Instagram account are stored to operate the Service and are revoked when you disconnect the channel.
• Least privilege internally. Access to production systems is limited to the people who need it to operate and support the Service.

Audit logging

Sign-ins, permission and role changes, channel connections, exports, and access to patient records are written to a per-organization activity log that administrators can review in the app. The activity log is retained for approximately 183 days and then purged automatically.

Application security

The browser application is served under a Content Security Policy that does not permit unsafe-eval; the client is precompiled at build time rather than evaluated at runtime. Incoming webhooks from Meta and Telnyx are signature-verified before we act on them, so we only process payloads that genuinely originate from the platform.

Backups & recovery

The database is backed up automatically on a daily schedule, with point-in-time recovery available within the retention window, and backups are additionally replicated to a second AWS region for disaster recovery. Backups are encrypted with the same customer-managed KMS key as the primary data.

AI processing

To generate an automated reply, the contact record and the recent conversation transcript — including any images the contact sent — are transmitted over an encrypted connection to Anthropic's API. Anthropic does not use this data to train models. We do not currently hold a business associate agreement with Anthropic. You control whether automated replies are enabled and can take over any conversation manually at any time. See our Trust page for the full picture and for how to limit this exposure.

Subprocessors

We publish the complete subprocessor list, what each one receives, and whether a business associate agreement is in place, on our Trust & Compliance page. In summary: Amazon Web Services, Paubox, and Stedi handle PHI under a BAA. Anthropic, Meta, and Telnyx can receive information that may constitute PHI and are not covered by a BAA with us — each of those is tied to an optional feature you can leave disabled. Cloudflare and Square receive no patient data.

Data retention & deletion

Contacts, conversations, messages, call recordings, and transcripts are retained until deleted — there is no automatic expiry on this data. You can delete a contact or conversation from the app at any time, disconnect a channel at any time, and request deletion of your account and associated data. Security activity logs are purged automatically at approximately 183 days. Full details and contact addresses are in our Privacy Policy.

What we have not done yet

We would rather you hear this from us than discover it in diligence:

• We do not hold a SOC 2 report. We are formalizing the controls needed to pursue one.
• We have not commissioned an independent third-party penetration test.
• We do not hold business associate agreements with Anthropic, Meta, or Telnyx — see above.
• The Service does not provide 42 CFR Part 2 consent management; see our Part 2 statement.

Your responsibilities

Security is shared. We recommend enabling two-factor authentication, using a strong and unique password, limiting team access to those who need it, removing teammates promptly when they leave, reviewing the activity log periodically, and disconnecting channels you no longer use.

Reporting a vulnerability