Security and trust, SOC 2
SOC 2 Type II, and the controls behind it
wai holds a SOC 2 Type II report, and answers a buyer's SOC 2 questions in writing, control by control, as well as sending it. The controls behind those answers, encryption, role-based access, the audit trail and human sign-off, are listed here with what each one does.
Updated .
Where wai stands today
- Vendor assessment
- Answered in writing, control by control, for your intended use.
- Encryption
- AES-256 at rest and TLS 1.3 in transit.
- Access control
- Role-based and least-privilege, enforced in the database.
- Audit trail
- Every message, draft, approval and signature written to an event log.
What a SOC 2 report is
A SOC 2 report is an independent auditor's report on a service organisation's controls, assessed against the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy.1 It is a report, not a certificate, and it covers the controls over a defined period.
Buyers use it to check a vendor's controls without auditing them directly. Where a vendor has no report, the same questions are answered control by control, in writing and on request.
What wai does
- 01
Encrypts data with AES-256 at rest and TLS 1.3 in transit, on a managed key estate.
- 02
Enforces role-based, least-privilege access in the database, and gives its engineers a separate credential, never a clinic's.
- 03
Writes every message, draft, approval and signature to an event log your clinic can export.
- 04
Names every subprocessor, with thirty days notice before anything changes.
- 05
Aims at 99.9% availability, and tells your clinic first when something goes wrong.
What stays with your organisation
- Your own vendor assessment, with our written answers control by control.
- Access reviews for your own staff, by role.
The agreements we sign
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Questions
Does wai have a SOC 2 report?
Yes, a SOC 2 Type II report, sent under a mutual non-disclosure agreement. We also answer your SOC 2 questions in writing, control by control, with the controls on this page.
What do you send in place of a report?
Written answers, control by control, for your intended use, with the subprocessor list and the data-processing agreement.
Is SOC 2 a certification?
No. It is an independent auditor's report on controls over a period, assessed against the Trust Services Criteria.
Further reading
Security and trust- Read nextHIPAA
- Read nextUK GDPR
- Read nextThe clinic AI procurement checklist
- Read nextPublic sector
- SecurityHIPAA, and how wai protects your practice's patient data
- SecurityUK GDPR, and how wai handles your clinic's patient data
- SecurityThe NHS DSPT, and how wai supports your assurance
- SecurityData residency, and where wai keeps your clinic's records
Bring your security questions to a demo.
A 15 minute video call on your own clinic, with your SOC 2 questions answered in writing afterwards, control by control. Prices for clinics, groups and hospitals are on the pricing page.