--- title: "Security and HIPAA: patient data stored in the United States — Salisan" description: "How Salisan protects practice and patient data in the United States: where it is stored, who can see it, how the AI handles it, and our Business Associate Agreement." url: https://salisan.com/us/security --- # How we keep your clinic's data safe The short version first, then the details your IT team or privacy officer will ask for. - Where does Salisan store patient data? On Amazon Web Services in Northern Virginia (us-east-1), in an AWS account used only for the US service. Patient data and its backups stay in that region. AI requests are processed by Fireworks, which does not store them. - Is our data used to train AI models? No. We don’t use your data to train AI models, and our agreements and account settings with our AI providers prevent them from using it to train or improve their models. - Do you sign a Business Associate Agreement? Yes. Our BAA is part of the Terms for organizations in the United States: an account owner accepts it in Salisan before your practice enters patient data. For a copy signed by both parties, send the signed form at the end of the BAA to legal@salisan.com. - Can people at Salisan see our patients’ data? No. Our platform administration roles give no access to patient data, and impersonation is disabled. Access to our infrastructure uses single sign-on with multi-factor authentication and no long-lived access keys. ## For technical teams The safeguards our Business Associate Agreement and US privacy policy describe. ### Encryption - TLS 1.2 or higher for connections to Salisan and between our services. - AES-256 encryption at rest. ### Sign-in - Two-factor authentication and passkeys, and single sign-on on the Enterprise plan. - Your practice can require two-factor authentication for every member. ### Access control - Every request is checked on the server for the organization and the patient, including requests by AI tools and background jobs. - You manage your members, roles and care-team access. ### Audit trail - Every read, search, change, export and deletion of patient data writes an audit record, with a copy in a write-once archive. - Access audit records are kept for 7 years in write-once storage. ### AI - AI models run on Fireworks under a business associate agreement, with zero data retention: requests are processed and not stored. - Speech-to-text runs on Amazon Transcribe in AWS us-east-1, under the AWS Business Associate Addendum. - The patient details our AI tools read from the record give an age instead of a date of birth, and leave out address, contact details and government identifiers. - Patients under 13, patients you exclude, and patients under 18 while AI for them is off in Settings are kept out of AI features. - The Agent asks for confirmation before it sends an email or form, or creates, changes or cancels an appointment. - Web research sends a question from which patient identifiers are removed. ### Backups, export and deletion - Point-in-time database recovery and daily file backups for 35 days, in the same region, with a restore tested at least once a year. - You can view and export a patient's record, and correct and add to entries while keeping their history. - After your agreement ends, your workspace stays readable and exportable until an account owner closes it; if none has after 90 days, we close it, after telling them. A closed account stays readable and exportable for a further 30 days. We then destroy patient data and send your account owners a deletion certificate. Copies in backups expire within 35 days. ### Logs - Server logs, error reports and performance data are kept for 30 days. ### HIPAA program - Security and privacy policies reviewed every year, a named Security Officer, a security risk analysis kept current, yearly HIPAA training and a tested incident response procedure. - We notify you of a breach of unsecured protected health information without unreasonable delay, and within 30 calendar days of discovering it. ## Found a security issue? Tell us privately and we’ll work with you to fix it. We acknowledge every report within 3 business days, and we won’t take legal action over good-faith research that follows our policy. - Include the affected URL or feature, the steps to reproduce and the impact. - Don’t send real patient data. Describe what kind of data you saw instead. - Give us reasonable time to fix it before you disclose it publicly. Report to [security@salisan.com](mailto:security@salisan.com) [Read the disclosure policy](https://salisan.com/legal/vulnerability-disclosure) ## Documents - [Business associate agreement](https://salisan.com/us/legal/baa) - [Subcontractors](https://salisan.com/us/legal/subcontractors) - [Privacy](https://salisan.com/us/legal/privacy) - [Terms](https://salisan.com/us/legal/terms) - [Trust portal](https://trust.inc/salisan) ## Questions Send questions or your practice's security questionnaire to [security@salisan.com](mailto:security@salisan.com)