---
title: "Security at Tavrn"
description: "Protected health information, handled under HIPAA and audited for SOC 2."
canonical: https://www.tavrn.ai/security
updated: 2026-10-15
---

# Security at Tavrn

Protected health information, handled under HIPAA and audited for SOC 2.

[Visit our Trust Center](https://app.vanta.com/tavrn/trust/0tb5amch52699x97ykvhnb)

## Security by design

### Built for protected health information

Tavrn handles protected health information under HIPAA. A Business Associate Agreement is available on request and is reviewed with your team as part of the security review.

### Encrypted at rest and in transit

Records are encrypted at rest and in transit. They reach your team in the Tavrn app, over SFTP or through the API, whichever you choose.

### Access through your accounts

Your team signs in to Tavrn with Microsoft or Google single sign-on, so access follows your organization’s own accounts.

### Every step on the record

Every call, fax, email, mail and portal attempt Tavrn makes on a request is logged with its date, purpose and outcome. Ask for the Outreach Activity Report when you need the full history of a request.

### Independently verified

Third-party auditors assess Tavrn’s controls. Our SOC 2 Type 1 and Type 2 reports and HIPAA attestation are on our Trust Center, shared once your access request is approved.

## What to know before you integrate

The short version for engineering and security reviews. The full documents are on the Trust Center.

### HIPAA and a BAA

Production API traffic carries protected health information under HIPAA. A Business Associate Agreement is available on request and is signed before a live API key is issued.

### Data residency: AWS us-east-1

The Enterprise API and the records it retrieves run in AWS us-east-1 (N. Virginia), encrypted at rest and in transit.

[API reference](https://docs.tavrn.ai/api-reference/v2)

### Subprocessors

The current list of subprocessors is available on request as part of the security review, alongside the SOC 2 reports and HIPAA attestation.

### Sandbox is synthetic-only

sandbox.tavrn.ai runs in a separate AWS account with fictional facilities and patients. It never holds PHI, so you can integrate and run tests before any agreement is in place.

[Get a sandbox key](https://sandbox.tavrn.ai)

## Compliance and documents

Reports, attestations and policies are shared through our Trust Center on request.

- **HIPAA compliance**
- **SOC 2 Type 1 and Type 2**
- **BAA**
- **Security policies**

[Visit our Trust Center](https://app.vanta.com/tavrn/trust/0tb5amch52699x97ykvhnb)

## FAQ

## Do you sign a BAA?

A BAA is available on request. Ask during your demo and it is reviewed with your team as part of the security review.

## Can we see your SOC 2 report?

The SOC 2 Type 1 and Type 2 reports, HIPAA attestation and security policies are on the trust center. Request access there; documents are shared once the request is approved.

## What does the audit trail record?

Every call, fax, email, mail and portal attempt Tavrn makes on a request, with its date, purpose and outcome. Ask about the Outreach Activity Report if you need it per request.

## Request a demo

Tell us about your organization and we will walk through the platform and your security review.

[Book a demo](https://www.tavrn.ai/demo)