Built for regulated work. The posture has to match.

Buyers ask the same five questions on the first call: where does my data live, do you train on it, can I audit what your system did, what can your AI do on its own, and what happens when something goes wrong.

What we will not compromise on

In effect today, not on a roadmap.

We do not train on your content.: Customer sources and queries are never used to train, fine-tune or evaluate any model. Knowledge enters the certified layer only when a qualified human approves it.
Your data stays in your region, including at inference.: Certified context and its sources are stored in the GCP region you nominate — EU customers default to an EU region, UK customers to a UK region, India customers to an India region, and Middle East customers to the nearest supported regional boundary. Models run within your GCP boundary; your sources and queries are not sent to external model providers. We follow your regulator before our convenience.
Agents act within bounds you can see.: Our agents build and maintain context — they do not decide what is true. Every consequential action passes policy guardrails, and clinical, coverage and regulatory outputs require a qualified human's sign-off before they take effect. What each agent may access and do is configured per deployment and written to the same audit log as everything else.
It cites, or it refuses.: Every answer traces to a certified source. When there is no certified basis for an answer, the system declines rather than guessing, and the refusal is logged. In regulated work, a defensible “no” beats a confident guess.
Every action is logged, verifiably.: Queries, citations, refusals, builds and version transitions are written to a hash-chained audit log. Anyone with access can verify the chain on demand, without taking our word for anything.
Tamper-evident builds.: Each certified asset is sealed with a SHA-256 build hash plus an independent transparency-log attestation. The version your AI used is the version you can reproduce in any audit, indefinitely.
Customer data isolation.: Each organisation's data is segregated at the storage and processing tier. Cross-tenant queries are not architecturally possible. PHI is de-identified where the workflow allows.
Run it in your environment.: Beyond our managed cloud, Healthattica™ can deploy inside your own GCP organisation with VPC Service Controls, or fully self-hosted, so your sources and PHI never leave your perimeter.
How context is certified, and by whom.: Certification combines three sources of authority: Healthattica's knowledge engineers, who propose structured candidates from your sources; your organisation's own named domain experts, who hold sign-off authority over what runs in your environment; and, where engaged, Healthattica's credentialed reviewer network. Nothing is certified without a qualified human's approval, and who approved what is written to the audit log alongside everything else.

Compliance posture

Where the paperwork stands today, as of July 2026. We work with founding clients, and some items are in progress. Where a certification is on the roadmap rather than in hand, this page says so until that changes.

Compliance status as of July 2026
Standard	What it covers	Status
HIPAA	BAA available for US healthcare engagements	Available
21 CFR Part 11	Designed to support electronic-records and audit-trail requirements	Supported by design
GDPR / UK GDPR	DPA available on request	DPA available
UAE PDPL	Federal Decree-Law 45/2021; DPA available on request	DPA available
EU data residency	Default for EU customers	Default
UK data residency	Default for UK customers	Default
India data residency	Default for India customers	Default
Middle East data residency	Nearest supported regional boundary; subject to cloud region availability	Available on request
PHI de-identification	Available within supported workflows	Available
SOC 2 Type II	Independent audit targeted Q4 2026	In progress
ISO 27001	Certification planned	On roadmap
BYOK — customer-managed keys	Scheduled for general availability; today, at-rest encryption uses GCP-managed keys and tenant separation is the durable control	On roadmap
Sub-processors	List published on request	Published on request
Incident response	Named contact notified as soon as we confirm an incident	Without undue delay

How to reach us

Three inboxes, each monitored by the team that owns the question. Nothing bounces between functions.

General: hello@healthattica.comSecurity brief, DPA, BAA, commercial, partnership, press.
Privacy: privacy@healthattica.comGDPR and UK GDPR data-subject requests, DPA enquiries, sub-processor list. Answered within 30 days.
Security: security@healthattica.comVulnerability reports, incident contacts, coordinated disclosure. Acknowledged within two working days. Details at /.well-known/security.txt.