Our SOC 2 Type 2 audit is in progress. Meanwhile, the controls a security review asks about are in place: protected health information isolated in its own data plane, role-based access scoped to each organization with SSO and SAML sign-in, an audit row for every access to patient data, and 21 CFR Part 11 electronic signatures. Burna AI is built for HIPAA and 21 CFR Part 11 and signs a Business Associate Agreement with customers. For security documentation during a procurement review, write to [email protected]; the architecture an IT review asks about is set out at burna.ai/it.