Security & compliance
Built for the trust enterprise healthcare requires.
We work inside the systems that carry protected health information and keep care moving. That responsibility shapes how we build, how our technology acts, and how we account for every decision.
Open the Trust Center ↗Security is built into how we work.
Lateetud operates in regulated healthcare environments, alongside the electronic health records, claims systems, and data platforms our customers already run. We treat the protection of that data and the integrity of those workflows as a precondition for everything we do, not something added afterward.
Our controls are independently audited under SOC 2 Type II, and we enter into Business Associate Agreements with appropriate safeguards for protected health information on each engagement. The specifics are matched to the environment we are working in rather than asserted as a blanket claim.
The controls behind the commitment.
Beneath the audited posture are the practical safeguards you would expect of a partner handling protected health information. We keep the specifics of any engagement to the review itself, but the core controls are constant.
Encryption in transit and at rest
Data is encrypted both while moving between systems and while stored.
Least-privilege access, with MFA
Access to data is limited to those who need it, and protected by multi-factor authentication.
Incident response and breach notification
A defined incident-response process, with notification handled as our agreements and the law require.
US data residency
Data is held within the United States.
Regular testing
Ongoing penetration testing and vulnerability scanning, with findings tracked to resolution.
Independently audited
These controls sit within the scope of our SOC 2 Type II audit.
AI never acts on its own.
The concern most risk and compliance teams raise about AI is simple: what can it do on its own, and can we trust it. Our answer is built into how the technology works. Intelligence proposes, deterministic checks verify against defined rules, and a person approves anything consequential before it takes effect.
The model proposes
AI surfaces and drafts, but commits nothing on its own.
Deterministic checks verify
Rules-based validation confirms the proposal against defined constraints.
A person decides
Anything consequential is approved by a person before it takes effect.
Automation is earned, not assumed. Where a workflow can run straight through, it does so only after the controls are in place to make that defensible. Everything else stays with a person, and every action leaves an audit trail.
Your data stays yours, in the systems you already trust.
We integrate with your existing systems of record rather than replacing them, and we do not create a parallel copy of your operation to manage on the side. That keeps the data where your own governance already applies, and it means no dependence on a stack you cannot leave.
Every consequential decision has an owner and a record.
People remain responsible for the decisions that matter, and the system supports them rather than replacing their judgment. Each action taken through our platforms is traceable, so an outcome can be reviewed, explained, and stood behind. That is what makes automation acceptable in a setting where being wrong has real consequences.
Everything your security review asks for, in one place.
Our Trust Center publishes our current compliance posture and the documentation a review needs. Access to the reports and policies is granted on request, under NDA, through the portal itself.
SOC 2 Type II report
The current report, examined by Insight Assurance, available on request under NDA.
Security policies
Encryption, data management, access control, vulnerability management, third-party management, and business continuity and disaster recovery.
Continuous control monitoring
Live status of the controls behind the audit, rather than a point-in-time snapshot.
Risk and assurance documentation
Risk assessment, data retention, and cybersecurity insurance, alongside our incident response plan.
Need something that is not published there? Send us your security questionnaire or diligence request and we will work through it with your team.
Open the Trust Center ↗Reviewing us for an engagement?
We are glad to walk your security and compliance teams through our controls, share our SOC 2 Type II report under NDA, and answer the questions your review requires.