Your clients trust you with their most sensitive information. We take that trust seriously.
AI Accident Pilot is designed for HIPAA compliance. We adhere to the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. Below is a detailed overview of our security and compliance program.
1. HIPAA Compliance
- We sign Business Associate Agreements (BAAs) with every firm.
- All PHI is encrypted at rest (AES-256) and in transit (TLS 1.2+).
- Access is role-based, logged, and audited.
- We never use PHI to train AI models.
- We maintain audit logs and PHI access logs.
2. Data Security
- AES-256-CBC encryption for all PHI fields
- TLS 1.2+ for data in transit
- PDO prepared statements (no SQL injection)
- CSRF protection on all forms
- Rate limiting on authentication
- Audit logs for all user actions
- PHI access logs for every data touch
- Two-Factor Authentication (2FA) for all team members
- Firewall (UFW) and Fail2ban protection
3. Data Residency
All PHI is stored and processed exclusively within the United States.
- DigitalOcean (NYC1, NYC3) — Application server, database, PHI file storage
- DigitalOcean Serverless Inference (US East) — AI document generation
- No PHI is transferred, stored, or processed outside the US.
- This supports compliance with US state data residency laws, including Texas SB 1188.
4. Backups
- Daily encrypted database backups
- Weekly server snapshots
- 30-day backup retention
- Backups stored in DigitalOcean Spaces (US-based)
- Backup verification and restore testing
5. Security Policies
We maintain the following formal policies:
- Annual Risk Assessment — identifies and mitigates security risks
- Incident Response Plan — defines response to security incidents
- Data Breach Notification Policy — complies with HIPAA Breach Notification Rule
- Employee HIPAA Training Program — all team members trained
6. Sub-Processors
We use the following trusted sub-processors:
- DigitalOcean (US) — Hosting, storage, AI inference (BAA signed)
- Brevo (EU) — Transactional email (no PHI)
- Razorpay (India) — Payment processing (no PHI)
7. AI and PHI
- We never use PHI to train AI models.
- AI inference is used only to generate the specific documents you request.
- This commitment is also required of our AI sub-processors.
8. Compliance Contact
For compliance questions or to request a BAA:
Email: sukdev@finsecuretech.com
Response time: Within 1 business day