Security and Trust

Access to Adaptive Flow Studio requires account creation and authentication. We use standard practices for account security, including credential verification.

You are responsible for:

• Keeping your login credentials confidential
• Not sharing your account with unauthorized users
• Using a strong, unique password
• Notifying Adaptive Flow Health promptly if you suspect unauthorized access to your account

Adaptive Flow Studio includes role-based access controls that allow workspace administrators to manage user access, assign roles, and control what information users can view, edit, or export within the organization's shared workspaces.

Workspace administrators are responsible for managing user access appropriately, including removing users who no longer require access and ensuring role assignments reflect actual organizational need.

You are responsible for the data you upload, paste, save, analyze, share, and export through Adaptive Flow Studio. Adaptive Flow Health does not review or validate the content of customer data for compliance with HIPAA or other privacy laws.

Protected Health Information may only be used in approved workspaces with the appropriate agreements (including a Business Associate Agreement where required) and safeguards in place. See our Data Use and HIPAA Notice for details.

Adaptive Flow Studio is hosted on third-party cloud infrastructure selected for reasonable reliability and availability. We rely on reputable service providers for hosting, storage, and authentication.

Where your data lives. Adaptive Flow Studio is hosted on Microsoft Azure in the United States (East US 2 region). Data is encrypted in transit using TLS and at rest using Azure platform encryption. Users sign in through Microsoft Entra External ID, with multi-factor authentication required. Database access is isolated per account using row-level security, so one account's queries cannot read another account's data.

A list of the subprocessors that handle customer data is available on request.

We do not make specific claims about uptime guarantees, infrastructure redundancy, or disaster recovery beyond what is commercially reasonable for a SaaS product at our current stage.

Adaptive Flow Health uses reasonable administrative, technical, and organizational measures to protect the platform. These include:

• Access controls limiting who can access platform systems and infrastructure
• Reasonable technical safeguards for data in transit and at rest
• Monitoring and review of platform access and operations
• Vendor selection with reasonable security considerations

We review and update security practices as the platform evolves.

Adaptive Flow Health does not currently hold SOC 2 certification, HITRUST certification, FedRAMP authorization, or other third-party security or compliance certifications, and no third-party penetration test or HIPAA assessment has been completed yet. We maintain written information security and HIPAA compliance programs (including a HIPAA Security Rule risk analysis, vulnerability remediation targets, and a remediation plan with dates), which customers can review under a confidentiality agreement.

No system is completely secure. We make reasonable efforts to maintain platform security and will notify affected customers of material security events as required by applicable law or reasonable practice.

If you believe you have discovered a security issue, please contact us before disclosing it publicly. We appreciate responsible disclosure.

For security concerns, Business Associate Agreement inquiries, questions about data handling, or governed organizational use: