Enterprise-Grade Security and Privacy, Built for Healthcare
Viz.ai operates under rigorous, independently verified security and privacy standards, designed to protect clinical data at scale and meet the expectations of leading health systems, clinicians, regulators, and enterprise partners.
Protecting Patient Data Is Not Optional. It's Core to Who We Are.
At Viz.ai, security and privacy are foundational. Our platform processes highly sensitive protected health information (PHI) across 2,000 hospitals and health systems in the U.S. and Europe.
Operating at this scale requires more than compliance. It requires disciplined, continuously monitored controls, mature governance, and independent validation. We hold ourselves to that standard through globally recognized certifications, third-party audits, and ongoing assurance processes.
Our Trust Center provides full transparency into our security posture, policies, and audit artifacts, because trust requires visibility.
Independently Verified. Rigorously Maintained.
Viz.ai maintains a comprehensive security and privacy program aligned with leading international standards and subject to regular independent audits. These certifications reflect sustained investment in infrastructure, governance, and operational rigor.
Certifications
- SOC 2 Type II: Independent audit demonstrating the effectiveness of controls across security, availability, confidentiality, processing integrity, and privacy over a defined audit period. The report scope covers Viz.ai production systems and supporting infrastructure.
- HIPAA: Viz.ai operates a comprehensive HIPAA compliance program, including administrative, technical, and physical safeguards for the protection of PHI. Our program is supported by regular risk assessments, including third-party evaluations, and alignment of our SOC 2 controls to HIPAA requirements.
- ISO 27001 (Information Security Management System): Global standard for information security management systems (ISMS), demonstrating structured risk management and governance.
- ISO 27701 (Privacy Information Management System): Extension of ISO 27001 focused on privacy, supporting GDPR and global privacy obligations.
- ISO 27799: Healthcare-specific security controls tailored for clinical environments and PHI.
- ISO 27017 / 27018: Cloud security and data protection standards governing our cloud-hosted infrastructure.
- ISO 22301: Business continuity and resilience to ensure uninterrupted clinical workflows.
- ISO 27035: Information Technology, Incident Management
What this means for you
Viz.ai’s platform is independently validated to meet the security, privacy, and operational requirements expected by enterprise healthcare organizations—reducing vendor risk and accelerating security review processes.
GDPR Compliance in Practice
Viz.ai operates a comprehensive privacy program designed to meet the requirements of the EU General Data Protection Regulation (GDPR).
Our approach includes:
- Defined lawful bases for all data processing activities, tailored to clinical and operational use cases
- Data Protection Impact Assessments (DPIAs) conducted where processing presents elevated risk
- Privacy by design and by default embedded into product development and data flows
- Robust data subject rights processes, including access, deletion, and restriction workflows
- Cross-border data transfer mechanisms, including participation in the EU-U.S. Data Privacy Framework
- Ongoing privacy governance and documentation, aligned with ISO 27701 controls
This operational approach ensures GDPR compliance is embedded into how our platform is designed, deployed, and maintained—not treated as a one-time certification exercise.
Advantages of Security in the Cloud
Keeping your patient data secure is our most important focus, which is why we’ve built our technology and services on a reliable and secure architecture. Your data lives behind a secure firewall and is encrypted at every point in transit. Our infrastructure is designed using defense-in-depth principles, with layered controls across network, application, and data levels, and continuous monitoring for threats and vulnerabilities.
Viz.ai uses Amazon and other best in class tools for monitoring
Data is protected by best in class security measures and protocols
Data is encrypted in transit and at rest using the latest industry-standard cryptographic algorithms and protocols
We strive to build a culture of kindness.
Security in the cloud enables improved user experience
Full Transparency, On Demand
We provide customers and partners with direct access to the documentation needed to evaluate our security and privacy posture.
Through our Trust Center, powered by Drata, you can request and access:
- SOC 2 Type II Report
- HIPAA Compliance Documentation
- ISO Certificates
- Privacy Policies (U.S. and EU)
- Subprocessor List and Security Overview
- Independent Penetration Testing Summary
- Business Continuity and Disaster Recovery Plans
Access is streamlined to support efficient vendor security reviews and procurement processes.
All certifications are independently audited and verified. Viz.ai maintains continuous control, monitoring, and evidence collection through Drata to ensure ongoing compliance between audits.