Book a Demo
Trust center

Trust Center

Published security, privacy, and operational policies for PathwAI. Download the documents your compliance and vendor reviews need.

  • 22 policies published
  • 3 regulatory frameworks
  • Self-assessed posture
  • Updated May 2026
Email securityBook a review call

Regulatory alignment

How PathwAI maps to the regulations that govern health data.

Aligned

HIPAA

Health Insurance Portability and Accountability Act

Federal standards for protecting PHI, including administrative, technical, and physical safeguards for covered entities and business associates.

United States (Federal) BAA (Enterprise)
Aligned

HITECH

Health Information Technology for Economic and Clinical Health Act

Strengthens HIPAA enforcement and breach-notification requirements for electronic protected health information, backed by our PHI Breach Notification Policy.

United States (Federal)
Aligned

GDPR

General Data Protection Regulation

EU data protection requirements covering lawful processing, data subject rights, and cross-border transfer safeguards for personal data.

European Union EU instance only

Security overview

Infrastructure, encryption, access controls, and vendor questionnaire support.

Infrastructure and hosting

  • Edge hosting
  • DDoS and WAF
  • Availability

Data handling and encryption

  • Encryption in transit
  • Encryption at rest
  • Data minimization
  • Retention and deletion

Access controls

  • Workspace access
  • SSO / SAML (Enterprise)
  • PathwAI staff access

Incident response

  • Detection and triage
  • Notification obligations
  • Post-incident review
  • Escalation contact

HIPAA program

  • Administrative safeguards
  • Technical safeguards
  • Physical safeguards

What to expect in a compliance review

  • Security questionnaire responses
  • Architecture walkthrough
  • Documentation package
  • Procurement support

Policy Library

22

  • Acceptable Usage Policy

    Operations
    PDFDownload

  • Access Control Policy

    Security
    PDFDownload

  • Business Continuity Policy

    Operations
    PDFDownload

  • Change Management Policy

    Operations
    PDFDownload

  • Code of Business Conduct Policy

    Governance
    PDFDownload

  • Confidentiality Policy

    Privacy & Data
    PDFDownload

  • Data Backup Policy

    Data & Infrastructure
    PDFDownload

  • Data Classification Policy

    Data & Infrastructure
    PDFDownload

  • Data Retention Policy

    Data & Infrastructure
    PDFDownload

  • Disaster Recovery Policy

    Operations
    PDFDownload

  • Encryption Policy

    Security
    PDFDownload

  • Endpoint Security Policy

    Security
    PDFDownload

  • HR Security Policy

    HR & People
    PDFDownload

  • Incident Management Policy

    Security
    PDFDownload

  • Information Security Policy

    Security
    PDFDownload

  • Media Disposal Policy

    Data & Infrastructure
    PDFDownload

  • Password Policy

    Security
    PDFDownload

  • PHI Breach Notification Policy

    Privacy & Data
    PDFDownload

  • Physical Security Policy

    Security
    PDFDownload

  • Risk Management Policy

    Governance
    PDFDownload

  • Vendor Management Policy

    Governance
    PDFDownload

  • Vulnerability Management Policy

    Security
    PDFDownload

PathwAI Security Whitepaper

Self-attested security overview · Version 1.0 (full-platform scope)

DOCX Download

Subprocessors

Third parties used to deliver the service—name, purpose, and region.

  • Amazon Web Services Core hosting, compute, storage, and eventing (ingest, fan-out, delivery, operational state). US
  • Railway Application hosting for the admin application and flow runner. US
  • Cloudflare Edge delivery, web application firewall, and DDoS mitigation. Global
  • MongoDB Atlas Primary data store for configuration, profiles, and definitions. US
  • Tinybird Event analytics and segment evaluation. US
  • Twilio SMS and voice for patient communications, where enabled. US
  • Stripe Billing and subscription management. US / Global
View subprocessors

Legal agreements, program documentation, and privacy practices for the PathwAI product and website.

Privacy Policy How we collect, use, and protect personal and health-related data. Terms of Service Rules and conditions for using PathwAI. Business Associate Agreement For partners and customers handling protected health information. Data Processing Agreement GDPR and applicable privacy law addendum for Enterprise customers. Cookie Policy What cookies are set and how to manage preferences. Security overview Infrastructure, encryption, access controls, and vendor questionnaire support. HIPAA program PHI handling, safeguards, BAAs, and compliance documentation. Subprocessors Third parties used to deliver the service—name, purpose, and region.

Running a security review?

Send your questionnaire to [email protected] or book a review call. We respond quickly with the right context and documentation.

Book a review callEmail security