Security & compliance
How we protect patient data.
ISO 27001 certified security for your clinical AI workspace.
Trust centre
Certifications and compliance.
Rhazes helps clinicians write notes, find answers and code records with AI. Clinicians trust us with patient data, so security and privacy are built into how we design, host and run the platform.
Updated October 2026
CertifiedISO 27001Information security management
CertifiedEU Class I SaMDSoftware as a medical device
ReadySOC 2 Type IIAudit readiness
CompliantHIPAARequired and addressable safeguards
AlignedHITRUSTApplicable infrastructure controls
CompliantGDPRUnited Kingdom and European Union
CompliantCyber EssentialsFive core security controls
CompliantPIPEDACanada
CompliantAustralian Privacy PrinciplesAustralia
CompliantPDPASingapore
CompliantPDPOHong Kong
Data protection standards.
Rhazes is ISO 27001 certified and EU Class I medical-device software, with GDPR and HIPAA compliance built into our security programme.
Data is encrypted when sent and stored. People only see what their role allows, and access is logged.
Read the product privacy policySecurity controls.
Explore our certified security, tested controls and data protection.
Access checks and monitoring
Enterprise runs on secure cloud servers. Every request for access is checked (zero-trust), and activity is logged and monitored.
Regular security testing
We run penetration tests and security reviews to find and fix weak spots.
Protected encryption keys
Dedicated secure hardware protects your encryption keys and other secrets.
Separate data
Clinical data is kept apart from our system monitoring and analytics. Customer data is not used to train foundation models (large, general-purpose AI models).
Customer data is not used to train foundation models.
Large, general-purpose AI models.Controls in place.
The safeguards that protect our platform and the way we work, monitored continuously.
Infrastructure security
- Data encrypted at rest
- Data encrypted in transit
- Isolated network for our platform
- Firewalls that deny traffic by default
- Intrusion detection on servers and network
- DDoS protection
Business continuity
- Daily automated backups
- Backups tested regularly
- Backups copied to a second region
- Services run across separate data centres
- Updates released without downtime
Access management
- Role-based access
- Multi-factor authentication
- Single sign-on for internal systems
- Access and activity logged
Monitoring and response
- Monitoring around the clock
- Incident response process
- Centralised logging and alerts
- Configuration changes reviewed automatically
Organisational security
- ISO 27001 information security management
- Regular independent penetration testing
- Security updates applied daily
- Hardened servers
- Secure development practices
- Staff devices managed and protected
Data and privacy
- Customer data not used to train foundation models
- Data collected only for defined purposes
- Defined retention periods
- Data protection impact assessments
- Breach notification process
- Requests to access, correct or delete data handled
Data collected
- Customer personally identifiable information
- Personal health information
- Usage and device information
- Employee personally identifiable information
Hosting for your organisation.
Choose regional cloud or private hosting with Enterprise. Keep your data, AI models and clinical workflows under your control.
Choose your hosting, access and AI model setup with us to fit your organisation’s requirements.
- Hosting
- Regional cloudPrivate hostingYour chosen region
- Access
- StandardYour access rules
- AI models
- Rhazes defaultApproved by your organisation
Common questions.
Quick answers for your security and procurement review.
Is data encrypted?
Yes. Data is encrypted at rest with AES-256 and in transit with TLS.
Where is data hosted?
Our platform and customer data are hosted in the United Kingdom, on dedicated, isolated infrastructure. With Enterprise, you can choose a regional or private hosting setup that fits your organisation’s requirements.
Who can see patient data?
Only people whose role allows it. Access is checked on every request and logged.
Is customer data used to train AI models?
No. Customer data is not used to train foundation models.
How do you detect and respond to security incidents?
We monitor our infrastructure around the clock, with intrusion detection on servers and the network. Our incident response process covers investigation, containment and notifying affected customers where required.
How often is Rhazes tested?
Independent security firms penetration test Rhazes regularly, and our cloud infrastructure is tested at least once a year.
Can we see your security documents?
Yes. Certificates, our latest penetration test report and other security documents are available under NDA. Request them below.
Documents for your security review.
Get certification details, security reports and system diagrams for your procurement team. SOC 2 Type II ready; documents available under NDA.
- ISO 27001 certificate
- Penetration test report
- System diagrams
- Questionnaires