How we protect the documents you trust us with
Clinical records, contracts and financial data are some of the most sensitive files a business holds. Here is exactly how we handle them.
Status
- Compliance
- SOC 2, HIPAA and GDPR aligned
- In transit
- TLS
- Sign-in
- SSO through your identity provider
- Isolation
- Private workspaces
The controls in place today
| Area | Control |
|---|---|
| Compliance | SOC 2, HIPAA and GDPR alignedHandling aligned to all three, for clinical, financial and personal data. |
| Encryption | TLS in transitFrom your systems to ours and back. |
| Identity | Single sign-onThrough your identity provider. Offboarding is instant. |
| Access | Role-based accessPeople see only the projects they are on. |
| Isolation | Private workspacesProjects isolated to the people you name. |
| Infrastructure | Monitored cloud regionsHardened hosting with redundancy. |
| Accuracy | Human review on low confidenceValues under your review line go to a person, never a guess. |
What happens to your content
- Your content stays yours
- Customer content is processed only to deliver the service under your agreement. We do not sell personal information.
- Retention you control
- Content is kept per your agreement and available for export for 30 days after termination, after which it may be deleted.
- Subprocessors
- Service providers that help run the platform work under confidentiality obligations.
- International transfers
- Where required, transfers are protected with safeguards such as Standard Contractual Clauses.
A wrong value that looks right is a security problem too
Every value Sonar extracts carries its own confidence score. Anything under your review line goes to a person with the evidence attached, so an uncertain field never flows silently into your systems.
You set the review line per workflow. Raising it sends more fields to review; lowering it lets more flow straight through. Either way, nothing is guessed.
Security questions, answered
Are you SOC 2 certified?
Our handling is aligned to SOC 2, HIPAA and GDPR. We describe it as aligned because that is accurate; ask us for our security documentation as part of your review.
Who can see our documents?
Only the people you name. Projects sit in private workspaces, access is role-based, and sign-in runs through your identity provider.
How long do you keep our data?
Per your agreement. After termination, content is available for export for 30 days, after which it may be deleted.
How do we report a security issue?
Use the contact form and choose 'Security review'. A person will respond.