Security and trust
Security and trust at wai
wai encrypts every record, enforces access by role in the database and logs every message, draft, approval and signature. Each clinic's records are hosted in its own country, and nothing clinical sends without a clinician's signature.
Updated .
The controls
Data is encrypted, access is logged, and nothing clinical sends without a signature.
- Encryption
- AES-256 at rest and TLS 1.3 in transit, on a managed key estate.
- Access control
- Role-based, least-privilege access for clinic staff, enforced in the database rather than the application. Our own engineers reach production data through a separate credential, never a clinic's.
- Audit trail
- Every message, draft, approval and signature is written to an event log, and your clinic can export it.
- Data residency
- wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.
- Subprocessors
- Every one named, with what it does and the data-processing agreement in place, and thirty days notice before anything changes. The current list is sent on request.
- Human sign-off
- Nothing clinical sends without a clinician's signature, and nothing operational sends without your team's approval.
- Availability
- We aim at 99.9%. When something does go wrong, your clinic hears it from us first.
The questions buyers ask
- HIPAAwai is designed for practices covered by HIPAA and signs a business associate agreement with your practice before anything goes live.
- UK GDPRUnder UK GDPR your clinic is the controller of its patient records and wai is the processor, acting only on your instructions under a written data-processing agreement.
- NHS DSPTThe Data Security and Protection Toolkit is the self-assessment every organisation with access to NHS patient data must complete, and NHS buyers ask their suppliers for the evidence behind it.
- Data residencywai hosts each clinic's records in its own country, under that country's rules, and we set this up with your clinic before go-live.
- SOC 2wai holds a SOC 2 Type II report, and answers a buyer's SOC 2 questions in writing, control by control, as well as sending it.
Agreements and evidence
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Ask us for the credentials, documents and open items relevant to your intended use, each with a status and a date, and we send them.
Questions
Is wai HIPAA compliant?
HIPAA has no certification, so readiness depends on your role, the signed agreements and your operating controls. wai signs a business associate agreement with US practices before anything goes live.
Does wai hold a SOC 2 report?
Yes, a SOC 2 Type II report. Ask and we send it under a mutual non-disclosure agreement, with the subprocessor list and the data-processing agreement beside it.
Where are our records hosted?
In your clinic's own country, under that country's rules, set up with your clinic before go-live.
What can we ask you to send?
The credentials, documents and open items relevant to your intended use, each with a status and a date, with the subprocessor list and the data-processing agreement.
Further reading
All regulators- Read nextUK GDPR and ambient AI scribes
- Read nextIs an AI medical scribe HIPAA compliant?
- Read nextDo you need patient consent for an AI medical scribe?
- Read nextWhere patient data lives, and for how long
- Read nextThe clinic AI procurement checklist
- Public sectorFor the NHS and public bodies
- RegulatorsWhich regulator do you answer to?
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox, with your security questions answered in writing afterwards. Prices for clinics, groups and hospitals are on the pricing page.