Trust Center

Security and privacy at Filo

Filohealth Software, Inc. builds healthcare software, and we hold ourselves to high standards of security practices. This page documents our compliance posture, subprocessors, and data processing agreements.

Generate a signed DPA View subprocessors

Compliance

GDPR

Compliant

EU General Data Protection Regulation. Customer data is hosted in the EU/UK, and Standard Contractual Clauses are incorporated into our Data Processing Agreement.

HIPAA

Compliant

Administrative, physical, and technical safeguards for protected health information. BAAs available for covered entities.

Security practices

Encryption everywhere

All data is encrypted in transit with TLS 1.2+ and at rest with AES-256.

EU/UK data residency

Customer data is hosted in the EU and UK; the only US-based subprocessor is our payment provider (Stripe) which we have a DPA with.

Access control

Role-based access, SSO enforcement, and least-privilege reviews every quarter.

Vendor management

Every subprocessor is risk-assessed and bound by a DPA or BAA before use.

Incident response

Documented IR plan with customer notification within 72 hours of a confirmed breach.

Business continuity

Daily encrypted backups, tested restores, and redundant infrastructure.

Subprocessors

Third parties that process customer data on our behalf. Full details — locations, data categories, and safeguards — require a signed-in account.

Locations, data categories, and safeguards are visible to signed-in customers.

Subprocessor	Purpose	Location	Data categories	Agreement	Safeguards
Amazon Web Services	Cloud infrastructure & data hosting	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Vercel	Web application hosting & CDN	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Neon	Managed PostgreSQL database	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Railway	Application backend & background job hosting	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Stripe	Payment processing, transaction settlement, merchant fraud prevention, financial reporting	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Resend	Transactional email delivery	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Twilio	SMS & voice notifications	Sign in to view	Sign in to view	Sign in to view	Sign in to view
PostHog	Product analytics	Sign in to view	Sign in to view	Sign in to view	Sign in to view
OpenAI	AI language model inference for product features	Sign in to view	Sign in to view	Sign in to view	Sign in to view
ElevenLabs	Text-to-speech voice synthesis	Sign in to view	Sign in to view	Sign in to view	Sign in to view
LiveKit	Real-time voice & audio infrastructure (WebRTC)	Sign in to view	Sign in to view	Sign in to view	Sign in to view
Deepgram	Speech-to-text transcription	Sign in to view	Sign in to view	Sign in to view	Sign in to view

Documents

Compliance documentation available to customers and prospects.

Data Processing Agreement (DPA)

Our standard DPA incorporating Standard Contractual Clauses. Generate a signed copy for your business from this portal.

Business Associate Agreement (BAA)

HIPAA BAA for covered entities and business associates.

Need a Data Processing Agreement?

Signed-in customers can generate a DPA pre-signed by Filohealth Software, Inc., made out to their own business name, in under a minute.