How we protect your data, and how to tell us if something is wrong.
The controls behind Burna AI, and the route for reporting a vulnerability. The architecture an IT review asks about is on IT and security.
How your data is protected.
PHI in its own plane
Protected health information lives in an isolated data plane, separate from identity and billing. De-identified projections feed everything else.
Every access recorded
Access is audited row by row, with complete audit trails.
HIPAA and a signed BAA
A HIPAA-aligned architecture, with business associate agreements signed.
21 CFR Part 11 signatures
Sign-offs use 21 CFR Part 11 electronic signatures.
Who gets in
SSO and SAML sign-in, role-based access, and every record scoped to your organization.
Who else touches the data
Every category of subprocessor is published, with its purpose and whether it can reach PHI.
/subprocessors →Reporting a security issue.
If you have found a vulnerability in the website, the platform or our infrastructure, email the details to us and we will work it through with you.
- Acknowledgement within 2 business days.
- An initial assessment within 5 business days.
- Remediation within 30 days for confirmed issues, where feasible.
- Public credit on resolution, under your preferred name or anonymously.
- Safe harbor for research done in good faith under the policy.