SOC 2
Active SOC 2 readiness program; Type I engagement not yet started.
How Chronos protects the medical records and case data law firms trust us with.
Read our security overview and subprocessor disclosures for the underlying policies and details.
Active SOC 2 readiness program; Type I engagement not yet started.
HIPAA-aligned architecture; Business Associate Agreement available when the parties' roles and intended use require one.
Hosted on Aptible, whose infrastructure maintains HITRUST r2-certified controls and signs BAAs with every customer — Aptible's certification, not an independent Chronos certification.
39/40 automated infrastructure checks passing (98%); 100% of HIPAA-Required checks.
One documented exception: Elasticsearch log-store replication, with compensating controls. This is an infrastructure-check snapshot, not an independent Chronos certification.
Our HIPAA safeguards overview explains the architecture and BAA context.
$2,000,000 Technology E&O & Cyber Liability coverage, including an AI Coverage Endorsement, with a certificate of insurance available on request.
Chronos uses a zero-training, zero-data-retention LLM layer, US-only data residency, and customer-controlled deletion. Read the Data Practices section for the details and boundaries.
See the subprocessor disclosures for vendors, processing purposes, data categories, locations, and BAA status. We maintain the vendor list there rather than duplicate it here.
Our security overview and security policies provide the supporting detail.
Security researchers can find scope, reporting instructions, response targets, and safe harbor in our Vulnerability Disclosure Policy.
View the service status page for current status. Our published Service Level Agreement sets a 99.9% monthly uptime SLA target; this target is not a statement of measured uptime.
For security questions and requests, email security@medchronosai.com.
Available to customers under NDA once our SOC 2 Type I report is issued:
This is a document-availability notice, not a working download or a claim that either document has been issued.