Business Associate Agreement

Credentik, Inc. enters into a Business Associate Agreement ("BAA") with every customer that uses the Service to create, receive, maintain, or transmit Protected Health Information ("PHI"). The BAA is a separately signed PDF agreement that governs our handling of PHI on your behalf.

When you need a BAA

You need a signed BAA before submitting PHI to the Service if you are:

• A HIPAA Covered Entity (most healthcare providers, payers, and clearinghouses);
• A Business Associate of a Covered Entity that uses Credentik to perform work on the Covered Entity's behalf (downstream BA arrangement); or
• Otherwise subject to state laws (e.g., CMIA, Texas HB 300) that require a written agreement with downstream processors.

If you are not handling PHI and are using Credentik only for non-PHI workflows (e.g., internal training, marketing materials), a BAA may not be required. Our team can confirm based on your use case.

What the BAA covers

Our standard BAA mirrors the HIPAA-required elements at 45 CFR 164.504(e) and includes:

• Permitted uses and disclosures — limited to performing the Service and as required by law;
• Safeguards — administrative, physical, and technical safeguards consistent with the HIPAA Security Rule (45 CFR Part 164 Subpart C);
• Reporting of security incidents and breaches — to the Covered Entity within statutory timeframes, with reasonable detail to enable downstream notification obligations;
• Subcontractor obligations — written assurances from each subprocessor that handles PHI (see our subprocessor list);
• Access, amendment, and accounting rights — assistance with individual rights requests under 45 CFR 164.524, 164.526, and 164.528;
• Return or destruction of PHI on termination, with limited retention only where legally required and continued protection for any PHI retained;
• Term and termination aligned with the Master Services Agreement / Terms of Service.

How to sign

1. Request the BAA using the button below. We'll email you a PDF within two business days, pre-filled with your agency name and contact.
2. Review with your counsel. Reasonable edits are typically negotiable; please return redlines as comments in the PDF.
3. Sign and return via email reply or DocuSign. We will countersign and return a fully-executed PDF.
4. Upload to your agency profile in Credentik (Admin → Compliance → BAA). Your tenant will be flagged as "BAA on file" and you can begin submitting PHI.

Subprocessor list

The following subprocessors may handle PHI as part of providing the Service. We maintain written agreements with each. The current list is also maintained on our Security page.

• Railway Corp. — Application + database hosting (PostgreSQL, US-East).
• Resend, Inc. — Transactional email delivery.
• Stripe, Inc. — Payment processing (does not receive PHI).
• Anthropic PBC — AI features when explicitly invoked. PHI is excluded from AI calls by default; AI usage on PHI requires explicit opt-in.

We will notify you at least 30 days before adding a new subprocessor that materially handles PHI, and you may object during that window.

Breach notification

If we discover a breach of unsecured PHI affecting your agency, we will notify your designated security contact without unreasonable delay and in no case later than 60 days after discovery, in accordance with 45 CFR 164.410. Our notification will include the information required by 45 CFR 164.404(c) to enable your downstream notification obligations.

Contact

BAA / compliance: legal@credentik.com
Security incidents: security@credentik.com