Security & compliance
What protects your documents — and what we have not earned yet
Most vendor security pages list aspirations. This one splits everything into two lists: controls running in production today, and things we do not have. If a control matters to your review and it is on the second list, tell us and we will give you a date rather than a claim.
In place today
Per-tenant isolation
Every organization is a separate tenant. Database access is enforced by row-level security policies, and document storage buckets are scoped so one tenant cannot read or write another tenant's objects.
Authentication and MFA
Email/password and Google sign-in, with multi-factor authentication available via authenticator app (TOTP) or email challenge. Administrators manage members, roles, and seat limits from the identity console.
Tamper-evident audit trail
Each document is hashed with SHA-256 at upload and at completion. Every view, consent, and signature event is timestamped with actor and IP, and exported as a certificate of completion bundled with the signed PDF.
Encryption and data handling
Data is encrypted in transit (TLS) and at rest by the managed cloud platform we run on. Document content is processed only to produce your result — it is never used to train AI models, and AI processing is performed through a commercial gateway with no training rights.
Not in place yet
SOC 2 Type II
Not held and no audit is currently in progress. We will publish the auditor, scope, and report date when that changes — and nothing before.
HIPAA compliance and BAAs
The platform is built with PHI-handling patterns (tenant isolation, access logging, audit trails), but we do not currently hold a HIPAA attestation. A Business Associate Agreement is executed in-app: a workspace admin reads the agreement, types their legal name and title, signs, and the executed record — agreement version, SHA-256 fingerprint of the text, signer, timestamp, IP address, and browser — is written to an unalterable log. The agreement follows the required elements of 45 CFR §§ 164.314(a) and 164.504(e) and is governed by Maryland law. PHI features (patient consent, HIPAA authorizations, client consent requests) stay locked for a workspace until that acceptance exists. Counsel has approved the agreement, including a 30-day breach-notification window and a 15-day cure period; Section 9 (liability and indemnification) has been inserted; only the floor dollar amount of the 9.2 liability cap is still blank. The downstream gap described below is not yet closed, so do not place PHI in the product on the assumption that a BAA is in force.
Downstream BAA with our hosting platform
ClinReady Sign runs on a managed application and database platform that holds ISO 27001 and SOC 2 Type II but does not offer a Business Associate Agreement today. Because a covered entity's BAA chain has to reach every subprocessor that can touch PHI, we cannot offer a BAA of our own until that link exists. Every PHI-bearing document byte in the product now moves through a single storage adapter that can be pointed at a BAA-backed object store (AWS S3 or any S3-compatible service) instead of the platform's own buckets, and captured signatures and ID images can be AES-256-GCM encrypted with a key held outside the database. Until a deployment is configured that way and we say so here, treat the product as suitable for de-identified or non-PHI agreements.
ESIGN / UETA
Signing follows ESIGN/UETA-style practice — explicit consent capture, signer identification, and a tamper-evident record — but no certification exists for these statutes and nothing here is legal advice.
Enterprise SSO / SAML
On the roadmap. Today, access is controlled through platform authentication, MFA, and role-based permissions.
Independent penetration test
Not yet commissioned. Findings and remediation status will be published here once one is complete.
Documents for your vendor review
Everything a security or procurement review normally asks for, in one place.
Report a vulnerability
Send findings to support@clinready.com with reproduction steps. We acknowledge reports within two business days and will keep you updated through remediation. Please do not run automated scans against production tenants or access data that is not yours — use the sandbox demo tenant instead.
Vendor review questionnaires, architecture detail, and subprocessor information are available on request from the same address.