Security and trust

Security and trust.

How Abastyan protects your data, how we use AI responsibly, and which frameworks the program is designed to. Written for the compliance, privacy, and IT reviewers who will evaluate us.

Book a demo →Talk to us

Enterprise security

Built to be inspected.

Every record, every access, every change is written to a tamper-evident audit log. When an auditor or investigator asks who saw what and when, the answer is one export away. Least-privilege roles keep sensitive fields masked until a logged request reveals them.

256bit encryptionAES-256 at rest, TLS 1.2 or higher in transit; customer-managed keys on custom deployments

NISTCSF alignedControls organized to the NIST Cybersecurity Framework. Built for compliance governance, not clinical care

LeastprivilegeRole- and facility-scoped permissions

Everyaccess loggedTamper-evident log of each view, edit, export, and login. Exportable per regulator or auditor request

Security controls

The controls behind every record.

Controls organized to the NIST Cybersecurity Framework and designed to the SOC 2 Trust Services Criteria, with HIPAA Security Rule safeguards as a reference.

/01

Encryption

AES-256 at rest and TLS 1.2 or higher in transit, with keys held in a managed key service and rotated automatically.

/02

Least-privilege access

Roles scoped by entity and facility. Sensitive fields are masked by default and revealed only on a logged request. MFA for administrators; SSO and SCIM supported.

/03

Tamper-evident audit log

Every view, edit, export, approval, and accepted suggestion is written to an append-only, tamper-evident log. Entries cannot be edited or deleted through the Service.

/04

Data minimization

Incidents are ingested from your EHR report as organizational fields only. Clinical narrative is never stored, and nothing requires an EHR integration.

/05

Resilience

Hosted in the United States across multiple availability zones, with encrypted backups in a separate region and disaster recovery tested at least annually.

/06

Vulnerability and incident response

Continuous vulnerability scanning and a documented incident response plan with customer notification under your agreement.

Responsible AI

AI assist supports your team. Your team decides.

AI assist, an optional add-on, supports your team with first drafts of corrective actions, plans of correction, root-cause analyses, policies, committee summaries, board narratives and regulatory change summaries, then checks each draft against the elements it must contain. Identifiers are removed before anything is sent, nothing enters the record until a person accepts it, and every accepted draft is logged. The rules-based completeness checks remain on every plan.

People decide

AI assist drafts and flags gaps. A named person edits and accepts every draft before it enters the record.

Always labeled

Every draft is marked as an AI draft, can be edited or discarded, and is recorded in the audit trail when accepted.

Identifiers removed first

Names, contact details and record numbers are stripped before a draft request is sent. Customer data is never used to train models.

Tested before release

Features are evaluated for accuracy and for uneven performance across groups before release and on a schedule afterward.

You choose

AI assist is off unless your organization adds it, and it can be switched off at any time.

What the assist does

Drafts CAPs, plans of correction, root-cause analyses, policies, committee and board narratives, and regulatory change summaries

Checks each draft against its required elements and flags what you still need to supply

Uses bracketed placeholders instead of inventing facts

On every plan, without the add-on: rules-based completeness checks, template wording, precedent and pattern detection

What it never does

Make regulatory, clinical, staffing, or eligibility determinations

Change a record without a person accepting it

Send names, contact details, or record numbers

Train on your records or your conversations with us

Read the AI Governance & Ethics Policy →Govern your own AI tools

Framework alignment

The standards the program is designed to.

We describe these as alignment, not certification. Current attestation status and supporting documentation are shared with customers and qualified prospects under NDA.

FrameworkHow Abastyan aligns

HIPAA Security Rule

Administrative · Physical · Technical

Administrative, physical, and technical safeguards are applied across the entire environment, which means any sensitive information entered incidentally is protected at the same level as the rest of the record.

SOC 2 Trust Services Criteria

Security · Availability · Confidentiality

Controls designed to the criteria.

NIST Cybersecurity Framework

Identify · Protect · Detect · Respond · Recover

Used to organize the security program and its annual risk assessment.

NIST AI Risk Management Framework

Govern · Map · Measure · Manage

The framework any AI feature must pass before release. Today’s assist is rules-based.

HHS trustworthy AI guidance

Health and human services

Informs our principles on transparency, fairness, privacy, and human oversight.