Trust & Security
Last updated: October 2026
Our security commitment
NephroSense AI is clinical decision support software used by licensed healthcare professionals. Protecting the confidentiality, integrity, and availability of any health information the platform processes is a core engineering priority, addressed with defense-in-depth controls across the application, the data layer, and the cloud infrastructure.
Encryption
Data is encrypted in transit using TLS 1.2 or higher. Databases and object storage are encrypted at rest with customer-managed keys held in AWS Key Management Service. Protected health information payloads receive an additional application-level envelope-encryption layer for defense in depth, so the most sensitive fields are protected independently of the underlying storage encryption.
Infrastructure
NephroSense AI runs on Amazon Web Services, using services drawn from the AWS HIPAA-eligible services list under an executed AWS Business Associate Addendum. Application components run in private network segments with no direct inbound internet exposure; public traffic terminates at a load balancer behind a web application firewall. Infrastructure is defined as code and changes are reviewed before deployment.
Access control and audit logging
Access to the clinical application requires per-clinician authentication; there are no shared logins. Administrative actions and access events are recorded in an audit log retained for six years in write-once storage. Audit records capture who acted, what they did, and when, and are designed never to contain clinical content.
Subprocessors and vendor management
Our primary infrastructure subprocessor is Amazon Web Services. We maintain a current inventory of every subprocessor that may process health information together with the status of its Business Associate Agreement, and we do not route protected health information to any vendor without an executed agreement in place. The full subprocessor list is available to customers and partners on request.
Business associate agreements
NephroSense AI will execute a Business Associate Agreement with covered entities and partners before processing protected health information on their behalf. To request a BAA, contact security@nephrosenseai.com.
Regulatory Posture
NephroSense AI is a Clinical Decision Support tool intended for use by licensed healthcare professionals under physician oversight. It does not make autonomous clinical decisions. The treating physician and the healthcare institution remain responsible for clinical judgment and for their own obligations under applicable health-data regulation.
Vulnerability Disclosure
We welcome reports from security researchers. Suspected vulnerabilities can be reported to security@nephrosenseai.com; our coordinated-disclosure policy sets out scope, response targets, and safe-harbor terms. A machine-readable security contact is also published at /.well-known/security.txt in line with RFC 9116.
Contact
For security, privacy, or compliance questions, contact NephroSense AI at security@nephrosenseai.com.