Skip to main content

Trust Center

SECURITY YOU CAN VERIFY.

How TurnKey protects your practice and your patients' data, and the documents your team needs to review us.

Request documentsBrowse documents

Last reviewed

AICPA SOC 2 Type I, audited by Thoropass
  • SOC 2 Type I complete
  • SOC 2 Type II in progress
  • HIPAA, with a BAA for every practice

Where we stand

Compliance

SOC 2 Type I

Complete

Independent auditor Thoropass Assurance examined the design of our security controls for the TurnKey AI Practice application as of April 1, 2026, and issued a clean opinion on May 14, 2026.

Scope: Security, under the AICPA Trust Services Criteria.

Request the report (SOC 2 Type I report, by email)

SOC 2 Type II

In progress

Our observation period runs June 1 to November 30, 2026. A Type II audit tests how our controls operate across that whole period, not just how they are designed.

HIPAA

BAA available

TurnKey is a Business Associate under HIPAA. We sign a Business Associate Agreement with each practice we serve and maintain administrative, physical and technical safeguards for protected health information.

Request our BAA (Business Associate Agreement, by email)

Penetration testing

Annual

An independent team at Thoropass ran a gray-box penetration test of the application in May 2026, scoped to every user role from patient to provider, with a focus on keeping each practice's data separate.

Request the summary (Penetration test summary, by email)

Documents

Everything your review needs

Public documents open right here. Confidential documents are shared with customers and prospective customers, under NDA where marked: request one and we will follow up by email.

Public

On request

AI and patient data

AI THAT STAYS INSIDE THE BAA.

  • The AI in TurnKey, from note generation to transcription, runs on Amazon Web Services inside our AWS environment, under our Business Associate Agreement with AWS.
  • Our language models run on Amazon Bedrock. Model providers cannot access your prompts or patient data, and Bedrock does not use them to train models.
  • AI services that are not covered by a Business Associate Agreement are blocked from patient data in the application code.

How we protect data

Security practices

A summary of the controls described in our SOC 2 Type I report. The full report is available on request.

Infrastructure and network

  • Hosted on Amazon Web Services (AWS) in the United States.
  • Private network segmentation (Amazon VPC) and security groups control traffic between systems.
  • A web application firewall (AWS WAF) filters traffic before it reaches the application.
  • Development and testing happen in environments kept separate from production.

Data protection

  • Customer data is encrypted at rest in every data store that holds it.
  • Customer data is encrypted in transit over public networks.
  • Encryption keys are managed in AWS Key Management Service, and application secrets in AWS Secrets Manager.
  • Documented procedures cover data classification, retention and secure disposal.

Access control

  • Role-based access on the principle of least privilege, with a unique account for every person.
  • New access requires a documented request and manager approval.
  • Multi-factor authentication is required for production infrastructure.
  • Access is reviewed regularly and removed within 24 hours when someone leaves.

Monitoring and vulnerability management

  • Centralized logging with AWS CloudTrail and Amazon CloudWatch.
  • Threat and intrusion detection with Amazon GuardDuty, with alerts routed to the people who can act on them.
  • Automated scanning with Amazon Inspector, quarterly vulnerability scans and routine patching.
  • An independent penetration test every year.

Secure development

  • Every change is reviewed, tested and approved before it reaches production.
  • Changes are tracked in a central system of record.
  • Production systems follow documented hardening standards.

People

  • Background or reference checks before anyone can reach production systems or sensitive data.
  • Confidentiality agreements and a code of conduct, acknowledged at hire.
  • Security training at hire and every year after.

Governance and vendor risk

  • An Information Security Policy, reviewed and approved at least once a year.
  • A Risk Committee with independent members oversees the security program.
  • A formal risk assessment every year.
  • Critical vendors work under written security commitments and are reviewed every year.

Incident response and continuity

  • A documented incident response plan, tested every year, with a review after any significant incident.
  • Practices are notified of a breach of unsecured PHI without unreasonable delay, and no later than 60 days after discovery.
  • Documented business continuity and disaster recovery procedures.

Questions

Frequently asked

Will you sign a BAA with our practice?

Yes. TurnKey is a Business Associate under HIPAA, and we sign a Business Associate Agreement with each practice we serve. You can request our standard BAA from the documents list on this page.

Is TurnKey SOC 2 compliant?

We completed a SOC 2 Type I examination with Thoropass Assurance: the report is dated May 14, 2026, and covers our controls as of April 1, 2026. Our SOC 2 Type II observation period runs June 1 to November 30, 2026.

Where is our data stored?

In Amazon Web Services data centers in the United States, encrypted at rest and in transit.

Can AI model providers see our patient data?

No. Our language models run on Amazon Bedrock, inside our AWS environment and under our Business Associate Agreement with AWS. Model providers cannot access your prompts or patient data, and Bedrock does not use them to train models.

How do we report a security concern?

Email info@turnkeyaipractice.io with the details. Please leave patient information out of your message.

Questions for our security team?

Send document requests or security concerns. Please leave patient information out of your message.

info@turnkeyaipractice.io