Compliance and Security Overview
This Trust Center provides transparent visibility into Kyan Health's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
SOC 2 Type 1
ISO 27001
GDPR
HIPAA
Third parties that process data on our behalf under strict contractual safeguards.
3CX
Software-based private branch exchange (PBX) phone system.
Aircall
Cloud-based phone system and call center software.
Algolia
Search and discovery platform. Kyan use: search indexes for counsellor profiles, library content, translations. Decision 2026-09-07: Algolia receives no clinical data, so no BAA is required. Control: the legacy therapist_sessions / chat_analytics / video_call_analytics indexes (member names + session times) are deprecated and being deleted under ENG-1612; only counsellor PII and content remain.
Comp AI
Compliance management platform (ISO 27001, SOC 2, GDPR, HIPAA) used across the company to run the ISMS: policies, evidence tasks, training, device checks, and the risk and vendor registers. Contracting party: Bubba AI, Inc. (United States). Personal data: names, email addresses, job titles, device identifiers, IP addresses and compliance records of staff. Connected to Google Cloud and Google Workspace for automated checks and staff sync. Sub-processors: AWS, Vercel, Stripe, Anthropic, OpenAI (all United States). DPA in place; transfers under Standard Contractual Clauses (RoPA ref. TOOL30).
Descope
Customer identity provider (CIAM) for the Kyan member/counsellor/Engage apps: stores login email, display name, phone, password/TOTP credentials and enterprise SSO tenant mapping. System of record for member identity PII since the 2026 Descope migration. HIPAA BAA executed 2026-07-01.