Solution Security and Information Protection

Solution Security and Information Protection

Chronilogix delivers the solution in partnership with SpSoft, its technology provider responsible for implementing, operating, and maintaining security controls within the scope of its services.

SpSoft’s responsibilities include application and cloud infrastructure security, access management, data protection, oversight of technology providers’ security arrangements, and security reviews before production releases. These controls are designed to protect the confidentiality, integrity, and availability of information and safeguard it against unauthorized access, disclosure, alteration, or destruction.

Data Minimization and De-identification

The solution minimizes the retention of personally identifiable information. Before conversation content is stored, it undergoes sanitization, redaction, and masking to remove identifiers across all 18 categories specified by the HIPAA Safe Harbor method. This method also requires the absence of actual knowledge that the remaining information could identify an individual, either alone or in combination with other information.

Retained conversation content is therefore intended for use in de-identified form. Incoming data may contain Protected Health Information (PHI) before de-identification is completed; accordingly, safeguards apply during processing as well as storage.

Cloud Infrastructure and Third-Party Services

The solution uses U.S.-based Google Cloud infrastructure and storage.

SpSoft maintains Business Associate Agreements (BAAs) covering the AI service providers involved in data processing, including language processing, speech-to-text, and text-to-speech services. Separate Zero Data Retention arrangements prohibit the retention of submitted conversation content by the applicable providers. These arrangements supplement, rather than replace, the obligations established under the BAAs.

Technical Safeguards

• Encryption at rest: Google Cloud data stores use AES-256 encryption by default.
• Encryption in transit: Connections to data stores and external services, as well as service-to-service communications within the solution, are encrypted.
• Access controls: Role- and permission-based authorization restricts access to data and application functions, defining the operations that users and services are permitted to perform.
• Data minimization: De-identification before persistence reduces the exposure of identifiable health information in retained conversation content.

Administrative Safeguards and Security Assurance

SpSoft maintains ISO/IEC 27001 certification and SOC 2 attestation, providing independent assurance over its information security management system and relevant controls within the scope of those assessments.

Security practices include:

• Annual penetration testing, with the most recent assessment conducted in September 2026.
• Regular vulnerability assessments of software dependencies and components.
• Mandatory code review and release approval, including a security review before each production deployment.

Physical Safeguards and Allocation of Responsibilities

Google Cloud provides physical security for the data centers and underlying hardware hosting the solution. SpSoft is responsible for application security and the security configuration of the cloud environment within its contracted scope.

These safeguards support the fulfillment of applicable HIPAA requirements when PHI is processed. Responsibilities among Chronilogix, SpSoft, and infrastructure providers are governed by the relevant agreements and BAAs, while each party retains its applicable statutory obligations.