Identity and access
Practice boundaries, roles, authentication and audit.
Trust · Security and data
Ask for the evidence behind the controls.
Assurance should match your deployment and data.
Request a security discussionSeparate the website from clinical care.
This website takes professional enquiries only: no patient information. The platform has its own assessment and terms.
What to establish before onboarding.
Data handling
Hosting, subprocessors, encryption, retention and deletion.
Operational assurance
Incident response, recovery and vulnerabilities.
AI data handling needs explicit terms.
Before sharing clinical information, obtain the approved terms for model processing, training, retention and third-party access. No blanket promise on training or residency.
Certification status.
We do not claim ISO 27001, SOC 2, or blanket HIPAA or GDPR compliance. A planned control is not a certification.
Questions
Common questions.
Is Echo One ISO 27001 or SOC 2 certified?
No. Echo One does not claim ISO 27001, SOC 2, or blanket HIPAA or GDPR compliance. A planned control is not a certification.
What should a practice establish about data security before onboarding?
Identity and access (practice boundaries, roles, authentication and audit), data handling (hosting, subprocessors, encryption, retention and deletion) and operational assurance (incident response, recovery and vulnerabilities), plus approved terms for AI processing, training, retention and third-party access.
Tell us what better care looks like for your team.
Registering interest is not a commitment to purchase.
Request a security discussion