Compliance and Security Overview
This Trust Center provides transparent visibility into Dermifi's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
SOC 2 Type 1
ISO 27001
HIPAA
Third parties that process data on our behalf under strict contractual safeguards.
1Password
Secrets / credential management (connection strings, API keys). No ePHI — BAA N/A. Stores credentials, not patient data.
Amazon Web Services
Amazon Web Services — S3 (message/Rx attachments), Secrets Manager, CloudTrail, GuardDuty, ElastiCache. Handles ePHI at rest (clinical docs) + secrets. **HIPAA BAA on file** — AWS Business Associate Addendum accepted via AWS Artifact (online AWS BAA, Doc #3256920v3). Acct 920211884522, us-west-2 + us-east-1; encryption at rest (SSE-S3/KMS). HIPAA Eligible Services scope.
Fly.io
Fly.io — ephemeral dev/agent boxes (domain-agent + demi devboxes). Signed HIPAA Business Associate Subcontractor Agreement effective 2026-06-11 (Doc ID db95a048…). Sub-processor; boxes hold no standing creds (runtime-delivered). BAA on file.
GitHub
Source control + CI (48 repos). No ePHI in repos — BAA N/A. Dependabot + secret scanning + push protection enabled.
Google Workspace
Google Workspace — email, identity/SSO, admin directory (staff email may carry ePHI). HIPAA Business Associate Amendment ACCEPTED 2026-06-11 by ian@dermifi.com (Admin console → Security & Privacy Additional Terms). BAA on file. 2FA enforcement scheduled 2026-06-25.