This page summarizes Almanac’s current compliance posture. Your signed agreement with Almanac controls. Confirm current status and scope with the Almanac team before relying on this information.
HIPAA
Almanac is HIPAA compliant on every plan, including Free. A Business Associate Agreement is available to covered entities on a paid plan, including individual clinicians.
Complete the BAA before entering PHI into Almanac.
The BAA covers Almanac’s handling of the information you provide. It doesn’t cover your devices or the third-party services you connect. Review each plugin and connector separately before using it with PHI.
See HIPAA configuration.
SOC 2
Almanac’s security practices are independently audited against the SOC 2 Type II Trust Services Criteria. The SOC 2 Type II report is available on request through the Trust Center.
During a security review, the Almanac team can provide current information about system architecture, data storage, production access, logging, and product controls.
Security practices
Almanac encrypts data in transit and at rest. Access to production systems is restricted and logged. Customer conversations aren’t used to train models, and paid placement doesn’t influence the information Almanac surfaces or cites.
Organization data is separated at the database level. A conversation connected to one patient can’t access another patient’s data.
See Privacy and data.
Prepare for a security review
Ask the Almanac team for:
- The BAA and current subprocessor list.
- Architecture and data-residency information.
- The SOC 2 Type II report.
- Production access and logging procedures.
- Incident response and notification procedures.
- Available retention settings and defaults.
See the Trust Center or email support@almanac.chat.