Trust center
Security and HIPAA trust center.
How Drawbridge handles and protects patient information.
Summary
Our commitments to every practice.
- HIPAA compliant
- Independent security audit passed in October 2026
- No AI models are trained on your data, including your calls.
- SOC 2 audit underway
Data scope
The information Drawbridge processes, and why
Incoming documents
Faxes, lab results and other documents sent to your practice, so they can be matched to the patient and filed to the correct chart.
Calls to your line
Who is calling and what they need, so the assistant can verify them and help with visits, balances and messages.
Schedule and chart data
Only what each task needs, through a dedicated Drawbridge user that your practice administrator creates.
Controls
Security controls
Access and identity
| Control | How it works |
|---|---|
| Multi-factor sign-in | Authenticator-app (TOTP) codes required for every staff user; each code works once. |
| Password policy | At least 12 characters; common passwords and simple variants refused; expiry every 90 days, the last five can't be reused. Stored as salted scrypt hashes. |
| Lockout | Five failed sign-ins in 15 minutes lock that username for 15 minutes; repeated failures from one network address are blocked too. |
| Automatic sign-out | After 15 minutes idle and 12 hours at most; signing out ends the session on the server. |
| Unique, role-based logins | Named users with staff, administrator and time-limited emergency roles. No shared logins in production. |
| Caller verification on every call | The phone assistant can read or change only the records of callers verified on that call by first name, last name and date of birth. Enforced by the server; at most two verified people and five lookups per call. |
Data protection
| Control | How it works |
|---|---|
| Encryption in transit | TLS 1.2 or later on every connection; staff pages use strict transport security and secure cookies. Production refuses unencrypted connections to the EHR and fax systems. |
| Encryption at rest | Data volumes and backups on encrypted disks, in our US cloud hosting and in MOATiT's data center. |
| US hosting | Hosted in the United States, in a US cloud region and in MOATiT's data center; single-tenant per practice. |
| Minimum necessary | The phone assistant receives only what a verified caller's request needs. Full SSNs are never stored; only the last four digits are used, to check a match. |
| No patient data in logs | Server logs carry tool names, IDs and outcomes only, never names, birth dates or chart contents. |
| Call recordings | Kept no longer than 30 days, with personal details redacted where the recording is kept. |
| Retention | Original faxes deleted 30 days after filing (the chart copy is the record); patient details on intake records after 90 days; call records after 30 days. |
| Backups | Every two hours, kept six months, encrypted and immutable. |
| Document integrity | Each document is fingerprinted on arrival and checked again before it is filed. |
| No model training on your data | No AI models are trained on your data, including your calls. |
Audit and monitoring
| Control | How it works |
|---|---|
| Hash-chained audit log | Every tool call, staff view and change is written to a hash-chained log kept for six years; edits and re-ordering are detectable with the verify tool. |
| Access and disclosure reports | Administrators can list every recorded access to one patient, or every action by one user, for any date range. |
| Security events | Sign-in failures, lockouts, rejected keys, emergency access and unusual export volumes are recorded as security events for review. |
| System status and alerts | Connection health checked every two minutes; MOATiT's help desk is alerted by email when it goes down and when it recovers. |
| Endpoint protection | Managed endpoint detection and response; critical patches applied within seven days after testing. |
Program, people and assurance
| Item | Detail |
|---|---|
| Business associate agreements | In place as HIPAA requires. |
| HIPAA training | Annual HIPAA security and privacy training for the MOATiT workforce. |
| Incident response | Documented incident response plan, with breach notification to practices as set out in the BAA. |
| Disaster recovery & continuity | Documented disaster recovery and business continuity plans. |
| Independent testing | Annual vulnerability scans and penetration tests by an independent outside firm. |
| Independent security audit | Security and HIPAA technical-safeguards audit of the Drawbridge code, October 2026: passed. |
| SOC 2 | Audit underway. |
AI safety
How AI and rule-based controls divide responsibility.
AI reads documents and holds the conversation. Deciding which chart a document belongs to, and whether a caller may hear anything, is done by written rules you can inspect.
- Documents are filed only when two identifiers match one patient with no conflicts; otherwise they are routed to staff
- Records requests, prior authorizations, refill requests and referrals routed to staff by default
- Original documents filed exactly as received, with clinical content left as written
- A learning week before Drawbridge takes on any work, then switched on in stages
- No medical advice on the phone; emergencies told to call 911
- Read-back and a yes before any appointment change
Report a security issue
If you believe you've found a vulnerability in Drawbridge or this website, email questions@moatit.com with "Security" in the subject line, or call (208) 900-6628 or (855) 550-6628. Please don't include patient information. We'll acknowledge your report within one business day.
Documents on request
Our security packet includes our vendor security questionnaire answers, HIPAA safeguards checklist, BAA template and the launch audit summary. Ask during your walkthrough or request it below.
Schedule a 20-minute walkthrough.
A MOATiT engineer demonstrates fax intake and a sample call. No patient data is required.