HIPAA
We sign a Business Associate Agreement for healthcare deployments and review the call workflow with your team before the agent goes live.
SECURITY & COMPLIANCE
Built for the calls that carry PHI.
topdoer.ai works under a signed BAA, keeps protected health information inside your organization, and can run on-premise or in a private cloud.
HIPAA, PHI, and where your data lives.
PHI protection
Agents collect only the health information the call needs. Transcripts, recordings, and call data stay scoped to your organization, with authorization required to play a recording.
On-premise & private cloud
Run topdoer.ai inside your own infrastructure or a dedicated private cloud when patient or customer data can't leave your environment.
Controls designed into the application.
Organization boundaries
The application includes membership-scoped queries and organization-level Row Level Security policies. They must be applied and tested on the configured Supabase project before production use.
Signed provider events
Provider callbacks are verified before call, messaging, or billing events are processed. Event identifiers support deduplication so retries do not create duplicate ledger entries.
Approved outbound actions
Outbound tools require authentication, an explicit approval flag, a verified phone workflow, and configured limits. Your team must still review consent, calling rules, suppression lists, and permitted use.
Where we stand today.
A plain summary of our agreements and deployment options. Ask the team for the documents behind any of them.
- HIPAA: BAA signed for healthcare deployments
- PHI: minimum necessary, organization-scoped, audit-logged
- On-premise or dedicated private cloud: available on Enterprise
- Encryption: in transit and at rest
- SOC 2: not yet certified
- Retention: configured per deployment
Review the service chain.
Voice, phone, email, hosting, authentication, and billing use configured service providers. Their terms and data handling matter alongside the application controls.
Review subprocessorsAsk for the right documents.
Request a BAA, a DPA, an on-premise deployment review, or details about your proposed data flow. The request opens your email client and goes to our existing contact channel.
Never miss a call again.
Put your calls, texts, and next steps in one workspace.