Every agreement, certification and safeguard behind PeptideCloud, documented in one place — for practices that handle protected health information.
Record last updated August 2026
The cloud platform PeptideCloud runs on is independently audited over time against the Trust Services Criteria for security, availability and confidentiality.
A certified information security management system governs how the underlying platform handles risk, access, change control and incident response.
AI systems used in the platform are governed by an independent standard covering safe, accountable and auditable AI operation.
Personal data is processed under a Data Processing Agreement with defined controller and processor roles, subprocessor obligations and data-subject rights.
These certifications are held by the certified cloud infrastructure PeptideCloud is built on, covering the hosting, storage and processing layer beneath the product. The HIPAA program below is PeptideCloud's own.
A signed Business Associate Agreement is executed before the first patient record can be stored.
Every practice executes a versioned BAA before any protected health information can be stored. Signatures are click-to-sign and recorded with signer name, title, email, IP address, user agent, timestamp and a cryptographic hash of the exact document version.
Staff see only the records their role requires. Provider assignment mode narrows visibility further so a provider sees only the patients assigned to them.
Unique user identification, two-step verification for staff accounts, administrator-controlled role management, and immediate revocation when a team member is removed.
Any use or disclosure of PHI not permitted by the agreement is reported to the practice without unreasonable delay, and in no case later than thirty calendar days after discovery.
Any subcontractor that touches PHI on our behalf is bound in writing to restrictions at least as restrictive as those that apply to us.
On termination, PHI is returned or destroyed. Where that is infeasible, the protections of the agreement continue to apply and further use is limited.
Controls enforced by the software itself, not by policy alone.
Permissions are resolved from roles held in a dedicated roles store — never from the client — and every role is scoped to a single organization.
Staff accounts complete an emailed verification code before the workspace unlocks. Administrators can require it for client portal accounts too.
Sessions end after a configurable idle period and again at an absolute maximum session length, so an unattended screen cannot stay open.
All traffic is served over TLS, and stored records, uploaded documents and backups are encrypted at rest.
PHI access, modification and export are written to an append-only audit trail with actor, patient, action, timestamp and context. Administrators can filter and export the trail.
Every export is authorized, attributed and logged, and a daily row cap limits how much data any single account can extract.
Each practice is a separate organization. Row-level access rules enforced in the database — not just in the interface — prevent one practice from reaching another's records.
The internal platform console is limited to authorized platform staff behind a separate login with its own verification requirements.
The full path of a patient record through the platform, and the control applied at each step.
Client and lead information arrives over TLS through the portal, intake forms or an authorized integration, and is attributed to one organization from the first write.
Records and uploaded documents are encrypted at rest and stored under row-level access rules scoped to the owning organization.
Each read is checked against the staff member's role and patient assignment, then recorded in the audit trail.
Exports and PDFs require permission, are attributed to the requesting user, and count against the organization's daily row cap.
Practices can export their full data set at any time. On termination, PHI is returned or destroyed under the terms of the BAA.
Read the agreement before you sign it. This is the exact text an administrator executes inside the product.
Privacy Policy
What we collect, why, and the rights you and your clients have.
DOC-03Terms of Service
The commercial terms the BAA supplements.
Data Processing Agreement
For practices with clients in the EU or UK. Request a copy at compliance@peptidecloud.ai.
We welcome reports from security researchers and from the practices we serve. We acknowledge receipt, investigate, and keep you updated until the issue is resolved. Please do not access, modify or retain data that is not your own while testing.
Send findings and questionnaires here
Compliance questions, security reviews and vendor questionnaires go to the same address.
compliance@peptidecloud.aiDo you sign a Business Associate Agreement?
Yes. A BAA is executed inside the product before the workspace unlocks, and no protected health information can be stored until an authorized administrator signs it.
Where is our data stored?
In certified cloud infrastructure covered by SOC 2 Type II and ISO 27001:2022, encrypted in transit and at rest, with each practice isolated as its own organization.
Who can see our patients' data?
Only the staff accounts your administrators create, limited by role and — when provider assignment mode is enabled — by patient assignment. Every access is logged.
Can we export everything we put in?
Yes. Administrators can export practice data and the full audit trail at any time. Exports are authorized, attributed and logged.
What happens to PHI if we cancel?
Export your data before closing the account. After termination, PHI is returned or destroyed in accordance with the BAA; where destruction is infeasible, its protections continue to apply.
Compliance monitored by Exec Groupware
