Security and HIPAA at Credentik
What your compliance team needs to know: where data lives, how patient information is protected and logged, what we promise if something goes wrong, and what we don’t have yet.
Patient data stays on Google Cloud, under Google’s BAA
The Credentik API, database, documents, backups, logs and secrets run on Google Cloud in the United States (us-east1), on services covered by the Google Cloud Business Associate Agreement. You accept Credentik’s own BAA when you sign up.
- The web app is static files served by Cloudflare Pages; the app talks to our API directly, so patient data does not pass through Cloudflare
- Staging and testing use made-up data only, never copies of customer data
- Secrets live in Google Secret Manager, never in code; every code push is scanned for leaked secrets
Encryption
- TLS for every connection, with HSTS
- Google encrypts all stored data, and Credentik additionally encrypts patient and claim fields one by one (AES-256) with keys held in Secret Manager
- Searchable fields use keyed blind indexes, so lookups work without decrypting the data
- Documents and logos sit in a private bucket and are only served through the app’s access checks
Every person sees only what their role allows
- Every record belongs to one agency, and every query is filtered to the signed-in user’s agency
- Roles for owners, admins and staff, custom staff roles per module, and separate logins for practices and providers that see only their own records
- Two-factor authentication, which agencies can require; idle sessions are signed out automatically
- Single sign-on (SAML 2.0 or OpenID Connect) on the Growth plan
- Deactivating a user revokes their access immediately
- Credentik support staff reach your data only through time-limited, logged impersonation
Who saw what, and when
- PHI access log: every view of patient information is recorded (who, what, when, from where). If the log can’t be written, the data isn’t shown
- Anomaly alerts: an hourly check flags unusual access, such as high volume, after-hours use, bulk exports or access by a deactivated user, and alerts your owners and admins
- Audit log: creates, updates, deletes and security events, kept seven years
- Sign-ins, failures and two-factor events are logged
Honest recovery targets
The database has daily automated backups with point-in-time recovery, plus a nightly logical backup kept for 30 days in a private bucket. Our recovery targets are four hours to restore after a database failure, with data loss measured in minutes, and about thirty minutes to roll back a bad release.
Credentik runs in one Google Cloud region without a warm standby, so a full regional outage could take one to three days to recover from. That is why our service level target is 99.5%, not “five nines”.
If something goes wrong, you hear from us
We follow a written incident response plan. If an incident involves your patients’ information, we notify your agency without unreasonable delay and no later than 60 days after discovery, as HIPAA requires, with what you need for your own notifications. Our BAA sets the exact timeline.
Report a suspected security issue to security@credentik.com.
Who else touches data, and what they see
| Service | Used for | Patient data (PHI)? |
|---|---|---|
| Google Cloud | Hosting the API, database, documents, backups and logs | Yes, under Google’s BAA |
| Cloudflare Pages | Serving the web app’s static files | No |
| Stripe | Subscriptions and patient payment links | Payment details only, no clinical data |
| Resend | Sending email | No, by design: emails carry links, not patient details |
| Sentry | Error reports | No: data is scrubbed before it is sent |
| Stedi | Eligibility checks and electronic claims, only for agencies that turn it on (claims are in pilot) | Yes, under a BAA before real use |
| Public registries (NPPES, OIG, SAM.gov, state boards) | Provider lookups, exclusion screening and license checks | No: provider information only |
Texting through Twilio and AI assistance through Google’s Vertex AI are coming soon. Neither is switched on, and neither will receive data until its agreements are in place.
Export any time, with a certificate when you leave
You own your data. Owners can export everything at any time. When an agency closes its account, there is a 30-day grace period, then data is deleted table by table according to a written policy, and you receive a destruction certificate. Records the law requires us to keep, such as audit logs, are retained for their period without decrypted patient data, then purged. Backups age out on their own schedule.
Straight answers
- No SOC 2 or HITRUST certification yet
- A web application firewall in front of the API is planned, not in place
- Backups are in the same region as production; a second region is planned
Need more for a vendor review? Email security@credentik.com for our security overview and policies, or book a demo and bring your compliance questions.
Frequently asked
Do you sign a BAA?
Where is our data stored?
Are you SOC 2 or HITRUST certified?
Does patient information go through email?
What happens to our data if we leave?
Run every client from one calm workspace
Try Credentik free for 14 days with your own providers and clients. No credit card, no sales call.
See plans and pricing · Already have an account? Sign in