Security & Privacy
Your patients trust you with their most sensitive information. You need to trust the tools you use to document it. Here's how Scriber earns and maintains that trust.
✅
HIPAA Compliant
🔐
AES-256 Encryption
☁️
Azure Cloud
📊
SOC 2 In Progress
🏥
HIPAA Compliance
- Scriber is designed from the ground up to handle Protected Health Information (PHI) in full compliance with the Health Insurance Portability and Accountability Act (HIPAA).
- We enter into Business Associate Agreements (BAAs) with covered entities and business associates as required by law. Email [email protected] to request a BAA.
- All staff with access to PHI receive regular HIPAA training and are subject to strict access controls.
- Our security policies are reviewed annually and updated to reflect the latest regulatory guidance.
🔐
Encryption
- All data at rest is encrypted using AES-256 — the same standard used by banks and government agencies.
- All data in transit is protected using TLS 1.3. We do not support older, insecure protocol versions.
- Authentication tokens are signed, time-limited, and stored securely. They cannot be used to access data after expiration.
- Encryption keys are managed separately from the data they protect, with rotation policies in place.
🛡️
Data Handling
- No PHI is ever cached in the browser or stored in browser local storage. Session data is handled server-side.
- Audio recordings are processed and then eligible for deletion based on your account retention settings.
- We do not sell, rent, or share your clinical data with third parties for marketing or advertising purposes.
- You can request deletion of your data at any time. We honor deletion requests promptly in accordance with HIPAA.
☁️
Infrastructure
- Scriber runs on Microsoft Azure, one of the world's most secure and HIPAA-eligible cloud platforms.
- Our infrastructure is configured in accordance with Azure's HIPAA compliance documentation and best practices.
- We are actively working toward SOC 2 Type II certification, with an audit in progress.
- All production systems are deployed with monitoring, alerting, and automated failover capabilities.
🔑
Access Control
- Role-based access control (RBAC) ensures that users can only access data appropriate for their role.
- All access to PHI is logged in a tamper-evident audit trail, as required by HIPAA.
- Enterprise plans support Single Sign-On (SSO) via SAML 2.0, enabling your organization's identity provider.
- Multi-factor authentication (MFA) is available and recommended for all accounts.
For full details on how we collect, use, and protect your data, read our Privacy Policy.
Need a BAA or Have Security Questions?
We're happy to provide a Business Associate Agreement and answer any security or compliance questions.