Security at Tavrn

Tavrn handles protected health information under HIPAA. A Business Associate Agreement is available on request and is reviewed with your team as part of the security review.

Records are encrypted at rest and in transit. They reach your team in the Tavrn app, over SFTP or through the API, whichever you choose.

Your team signs in to Tavrn with Microsoft or Google single sign-on, so access follows your organization’s own accounts.

Every call, fax, email, mail and portal attempt Tavrn makes on a request is logged with its date, purpose and outcome. Ask for the Outreach Activity Report when you need the full history of a request.

Third-party auditors assess Tavrn’s controls. Our SOC 2 Type 1 and Type 2 reports and HIPAA attestation are on our Trust Center, shared once your access request is approved.

Production API traffic carries protected health information under HIPAA. A Business Associate Agreement is available on request and is signed before a live API key is issued.

The Enterprise API and the records it retrieves run in AWS us-east-1 (N. Virginia), encrypted at rest and in transit.

The current list of subprocessors is available on request as part of the security review, alongside the SOC 2 reports and HIPAA attestation.

sandbox.tavrn.ai runs in a separate AWS account with fictional facilities and patients. It never holds PHI, so you can integrate and run tests before any agreement is in place.