Trust center
BAA and SOC 2 readiness
What APEX has today, what it does not have yet, and who touches your data. Nothing here is an audit result.
Certifications we do not hold
APEX does not have a SOC 2 Type I or Type II report and is not SOC 2 certified. No auditor has examined APEX. The map below is our own readiness self-assessment.
HIPAA has no official certification, so no one can be "HIPAA certified". APEX signs a Business Associate Agreement with every practice and keeps the safeguards listed here.
APEX is not ONC-certified EHR technology.
APEX has no HITRUST, ISO 27001 or PCI DSS certification of its own. Card data is handled by Stripe, which maintains its own PCI DSS validation.
Business Associate Agreement
Version 2026-10-16.1. Every practice accepts it inside APEX (Compliance) before storing real patient data. The acceptance is recorded with the signer, time and network address, and the owner can download it.
SOC 2 readiness (self-assessed)
Mapped to the AICPA Trust Services Criteria by our own team. An outside auditor has not reviewed it.
| Area | Status | Today |
|---|---|---|
| CC6 Logical access | in place | Multi-factor sign-in (authenticator app, passkeys), per-device trust, and server-enforced staff roles. |
| CC6 Encryption | in place | HTTPS/TLS in transit; sensitive chart and message fields sealed with AES-256-GCM at rest. |
| CC7 Monitoring and audit log | partial | Key actions (shares, agreement acceptances, EPCS steps) are logged and exportable. No 24/7 security operations center. |
| CC8 Change management | partial | Changes go through pull requests with type checks, automated tests and a build before merge. No independent change-approval board. |
| CC9 Vendor management | partial | Subprocessors are listed below. Formal annual vendor reviews are not yet documented. |
| CC3 Risk assessment | not started | No formal written risk assessment has been completed yet. |
| CC1/CC2 Policies and training | not started | Written security policies and staff security training records are not yet in place. |
| A1 Availability | partial | Hosted on a managed platform; practices can export their data at any time. No published uptime SLA. |
| C1/P Confidentiality and privacy | in place | Patient data is never sent to outside AI services; an automated code check blocks it. Privacy policy is public. |
Subprocessors
- Stripe: Card payments for practices and patient statements
- Twilio: Practice texts, calls and video visits (may carry patient contact details; practice-facing use only)
- Cloudflare: Bot protection (Turnstile) on sign-in
- Resend: Account and practice email (may carry patient contact details; practice-facing use only)
- Outside AI services: none receive patient data.
Need a security questionnaire filled in, or our BAA countersigned on your paper? Write to support.apex@tkhub.app.