Preparing for SOC 2, hospital procurement, or investor due diligence?
Scope
Any monitoring, CRM, AI, analytics, database, CI/CD, or support platform that can access health data may fall within your compliance boundary.
Review
Check BAA coverage, subprocessors, data location, retention, deletion, access controls, incident terms, and whether data is used for model training.
Decision
A recognised brand or SOC 2 report is not enough. Suitability depends on how the service handles your data and how your team configures it.
