Built for hospital security review.

No one is — HIPAA has no certification. What exists is a compliance program: adopted policies, implemented safeguards, risk analyses, training, and evidence. Ours is in force and documented in a 21-document package available under NDA. Vendors who say 'HIPAA certified' are telling you something about their diligence.

Yes. We maintain an attorney-drafted Business Associate Agreement template (45 C.F.R. §§ 164.314(a), 164.504(e)) with 10-business-day breach notice, subcontractor flow-down, and NIST 800-88 return/destruction terms. We also execute customer paper subject to counsel review.

Not yet, and we won't claim otherwise. SOC 2 Type I is targeted for December 2026 with the Type II report to follow in mid-2027; HITRUST e1 validated assessment is targeted H1 2027. The full timeline, including what we say publicly at each stage, is documented in ARKA-RDY-004.

No. Every patient, encounter, claim, and scenario in the ARKA demo is synthetic — generated by our synthetic-data tooling and tagged with an [ARKA-DEMO] marker. A quarterly officer-signed attestation (ARKA-DEMO-001) verifies the environment, and submitting PHI into the demo is prohibited by our terms.

Production runs on U.S. cloud infrastructure (AWS, Vercel, Supabase) under executed BAAs with each provider before any PHI flows. Tenant data is isolated with row-level security; ARKA staff access customer tenants only through a logged, ticketed support workflow.

No. Model training, evaluation, and analytics use synthetic or de-identified data exclusively (ARKA-PRIV-002), with disclosure-risk review on outputs. De-identification of customer PHI happens only where the BAA expressly permits it.