Security & Trust
Security Your CISO Can Verify.
Measurement platforms ask for your most sensitive data. This page is the posture that earns it, written for the people who will audit it, not the people who will market it.
If your security team has a questionnaire, send it. We answer those for a living.
The Short Version.
BAA, Before Any Data Moves.
A signed Business Associate Agreement is part of every healthcare engagement, executed before a single byte of your data touches our infrastructure. Not an add-on. Not a paid tier.
A Dedicated HIPAA Boundary.
PHI workloads run in an isolated AWS environment purpose-built for regulated data: hardened network boundaries, encryption in transit and at rest, least-privilege access throughout.
Fail-Closed Audit Logging.
Every administrative action and every cross-tenant access writes to a dedicated security audit channel: who, what, where, when. If logging fails, access fails. The system is built so that "we don't know who touched it" is not a possible answer.
Tenant Isolation by Design.
Mediaura Signal is multi-tenant, and isolation is architectural, not procedural. Access to a tenant's data requires an explicit, recorded, per-tenant grant. There are no blanket administrative keys. Your data is never visible to another client, including to our own staff without a logged, scoped grant.
AI & PHI
Aura Stays Inside the BAA.
The fastest-growing security risk in healthcare marketing isn't a breach. It's an employee pasting patient data into a consumer AI chatbot. Mediaura Signal was built so that risk is structural, not behavioral:
Sensitive Fields Stay in the Browser.
Signal's tag refuses to read password, payment card, and health-related form fields, so their contents never leave the visitor's browser. Whatever it does send travels over TLS to a dedicated collection service, where identifiers are hashed with a key unique to your organization before anything reaches the analytics platform. In healthcare deployments, all of it is handled as PHI under our BAA.
Aura Works Under the Same BAA.
Aura works inside the platform under the same BAA as everything else. Its language model runs in our cloud environment on a HIPAA-eligible service, and your prompts and its responses are not sent to the model's developer.
No Generative AI Training Without Consent.
Your data is never used to train a generative AI model, such as a language model or synthetic data generator, without your written consent.
Aura Doesn't Do the Math.
Every figure comes from the statistical engines, and Aura explains what they found. Review its summaries the way you'd review an analyst's.
Compliance
Compliance Posture.
HIPAA
Built for HIPAA-regulated organizations. Business Associate Agreement included. Signal was designed for regulated environments from the first commit, not retrofitted from an e-commerce product: first-party collection on a subdomain of your domain, privacy filtering at the point of collection, and EMR/CRM-aware integration designed for PHI-restricted systems.
42 CFR Part 2
Programs subject to 42 CFR Part 2 sign a Part 2 schedule to the BAA before deployment, before the tag goes on any of their properties or any of their data sources is connected.
SOC 2 Type 2 in progress
SOC 2 Type 2 examination in progress. We'll provide the report under NDA once it's issued.
The Documentation Packet.
Enterprise security reviews shouldn't depend on a sales call. Under NDA, we provide:
- Security architecture overview (data flows, boundaries, encryption, access model)
- Audit logging specification: what is logged, where, and retention
- Subprocessor list and data-handling commitments
- Completed security questionnaires (SIG Lite, CAIQ, or your own format)
- Incident response and breach notification commitments
- SOC 2 Type 2 report, once issued
Ask Us the Hard Questions.
The architecture was built for the audit. Most measurement vendors treat the security review as an obstacle between them and the contract. We treat it as the first demo.
Bold patterns. Boring rigor.
Request the Security Packet
Tell us who is running the review and what format you need. No demo, no sales call first.
What You'll Receive, Under NDA:
- Security architecture overview (data flows, boundaries, encryption, access model)
- Audit logging specification: what is logged, where, and retention
- Subprocessor list and data-handling commitments
- Completed security questionnaires (SIG Lite, CAIQ, or your own format)
- Incident response and breach notification commitments
- SOC 2 Type 2 report, once issued
Prefer email? Write to security@mediaura.io →