---
title: "Trust Center — Global | Arbol AI"
description: "The dossier your IT team and privacy officer will ask for: how every record travels, how we isolate each institution and the U.S. laws we answer to."
url: https://www.getarbol.com/legal/trust-global/
lang: en
alternates:
es: https://www.getarbol.com/legal/trust/
---
# Every record in its place. Every access, on the record.
The page your IT team, your privacy officer and your auditor will ask us for: how every record travels, how we isolate each institution, how we govern the AI, which laws we answer to and what we sign with you. Public, to the point and built to be shared.
Trust Center · Public document · Updated September 28, 2026
- Infrastructure
100% on Cloudflare, serverless
- Isolation
One database per institution
- Identity
MFA for 100% of users
- Encryption
AES-256 at rest · TLS 1.2+ in transit
- Your data & the models
Zero retention · zero training
- Standards we apply
HIPAA · SOC 2 · ISO/IEC 27001 · NIST
- Location
United States
- Incidents
We notify you within 72 hours
## Six things we sign.
Not promises: each one is backed by a contract, a verifiable technical control or a law that sanctions us if we fail.
1. ### Your data trains no models.
Model providers operate under zero retention and no training. What Arbol learns about your institution stays in your institution — and you switch that on yourself.
2. ### Never sold.
Not your data and not your patients'. Never shared with advertisers either. No exceptions, no fine print.
3. ### Every institution, apart.
Isolation here is infrastructure, not a software rule: two institutions never share a database — not to answer, not to predict, not to “improve the service.”
4. ### The person always knows.
The agent identifies itself as a virtual assistant from the first sentence and announces recording. On by default; it cannot be hidden.
5. ### Everything leaves a trail.
Every conversation is recorded and transcribed, and every access to a record is logged: who, what, when and from where.
6. ### You take it; we delete it.
Export everything whenever you want. When the contract ends we delete your data and confirm it in writing. Custody of the medical record is always yours.
## Serverless, on Cloudflare's network.
Arbol runs no servers: the app, the API, the agents and the integrations run entirely on Cloudflare's global network, with security at the edge before a request ever reaches our code.
- 0
servers, virtual machines or admin ports to patch or expose
- 300+
cities in over 100 countries, more than 60 of them in Latin America and the Caribbean
- 100%
network availability and 99.99% for compute in the published agreements
- 30 days
to restore an institution's database to any minute, without touching anyone else
- Every service runs isolated and with no public address: only the services authorized to call it can reach it.
- If a data center fails, traffic moves to the next one on its own, with nobody stepping in.
- Cloudflare is certified ISO/IEC 27001, SOC 2 Type II and PCI DSS Level 1, and health data only lives in services covered by the BAA we sign with it.
- Every change is reviewed, tested and rolled out gradually, and can be rolled back instantly. The infrastructure is declared as code.
- Continuous monitoring, with external availability checks every minute and no clinical data in the logs.
Network and compute figures come from Cloudflare's published agreements. Arbol's availability objective is 99.9% monthly; the contractual commitment lives in your order form.
## Seven checks between the internet and a patient's record.
Clearing one doesn't open the next: every boundary asks for its own proof and keeps its own record.
The internet
1. ### The network edge
TLS encryption, attack filtering and traffic limits, before a single line of our code runs.
2. ### Identity
Multi-factor authentication for every person, and security keys or passkeys for privileged access.
3. ### The front door
Every request carries a credential that is verified once and must belong to your organization. If it doesn't match, it's rejected.
4. ### The service
Every operation authorizes the specific resource: who owns it, for what purpose and with what consent.
5. ### The data
The query can only touch your organization's database. Another institution's ID simply doesn't exist there.
6. ### The way out
Integrations only talk to approved destinations, with your organization's credentials. No internal service has a public address.
7. ### The evidence
Every decision is logged with identifiers, never with clinical content.
Your patient's record
## People and systems, held to the same bar.
Every request carries an identity bound to a single institution — a person's or a system's.
### People
- Multi-factor authentication for 100% of users, no exceptions.
- Passkeys or security keys for privileged access.
- Your institution's single sign-on (SAML or OIDC), with automatic joiners and leavers through SCIM.
- A fresh factor to export data, manage users or change credentials.
### Systems
- OAuth 2.0 credentials bound to a single institution, never to a person.
- Least privilege per operation: no integration gets blanket admin access.
- Private-key signing: the secret stays on your institution's server.
- Optional IP allowlisting and immediate revocation.
Inside, identity is verified once and travels as a security context nobody can alter. Every service authorizes the resource it's asked for again, and background jobs check once more when they run: if access was revoked in the meantime, the operation stops.
Another institution's ID doesn't exist in your database: the answer is “not found,” and a denial event is logged.
## Every institution, its own database.
Filtering rows by an ID leaves isolation up to every single query: one careless query can expose everyone. At Arbol, every organization has its own database, so a query — correct or buggy — can only read its own organization's.
- What's shared is the code; the data, never.
- Full export and verifiable deletion, per institution.
- Point-in-time restore without touching any other institution.
- Automated cross-tenant access tests on every software change.
## Protection rises with the data.
Booking an appointment is not the same as governing a population's health, and the controls reflect it. Modules are switched on per institution: one that isn't active has no routes, permissions or data.
1. Patient contact · Agenda
### Contact & scheduling
Name, phone, email, appointments and channel preferences.
Controls
- One database per institution.
- Encryption in transit and at rest.
- MFA for everyone and an audit log.
- The retention your institution sets.
2. Phone · WhatsApp · text · email · web chat
### Conversations
What a patient says on a call or in a message may include health information: we treat it as sensitive.
Controls
- AI and recording notice in every conversation.
- A separate permission to hear or read transcripts.
- Sensitive data hidden from the analyses and reports that don't need it.
- Recordings deleted whenever your institution decides.
3. Ámbar (governance) · medical records
### Clinical data
Medical records, lab results, events, social determinants, billing, payer data, cohorts and each patient's risk.
Controls
- Data, purposes and controls agreed in writing before the module is switched on.
- Consejo Clínico reaches the care team only, never the patient.
- Access restricted to your network, or kept off the internet.
- A fresh factor to export or administer.
- Every read audited; custody and retention under your control.
### You tell us first. Then it's all in writing.
Before a module that processes health data is switched on, your institution tells us and we agree in writing on the data, the purposes and the reinforced controls. It's the same principle as the BAA we sign with Cloudflare: nobody processes health data without an agreement that says so.
## One connector per provider. One connection per institution.
777+ integrations on the same model. Twenty institutions connected to the same payer share the connector's code — nothing else.
1. ### One connection per institution.
Each institution has its own connection, with its own encrypted credentials, limits and circuit breaker: if one fails, the others keep going.
2. ### Write-only credentials.
Your administrator enters them once and nobody — not your team, not ours — can read them back.
3. ### The connector never sees your data.
The connector only asks and hands over: what the provider returns is stored by your institution's own service, in your database.
4. ### Closed egress by default.
Each connector only talks to its provider's destinations, encrypted and — when the provider requires it — with a client certificate or a fixed IP.
5. ### Independent of each other.
Each connector is deployed, monitored and switched off on its own, without touching the rest.
6. ### Your network, no open ports.
Systems that live inside your institution connect through outbound tunnels, with read-only credentials when reading is enough.
## You decide where access comes from.
Each module can be public, restricted or kept off the internet, as your institution requires, without changing the permission model.
1. ### Public
Over the internet, behind the edge filters and with multi-factor authentication. For your patients' channels and for staff who work across several sites.
2. ### Restricted
Only from your institution's networks, with IP allowlists at the edge and in identity. For example: the medical record, only from inside the hospital.
3. ### Private
No public hostname at all. People reach it from managed devices or from the hospital network, through a tunnel that opens outbound, with no open ports.
- Your own domain or your organization's subdomain, with certificates that renew themselves.
- Systems that live inside your network — your EHR, your scheduling — connect through outbound tunnels and, when reading is enough, with read-only credentials. Your team can cut the connection at any time.
## The model reasons. The platform authorizes.
Arbol's AI holds no privileges of its own: it gets no credentials and never reaches a database directly. Every action goes through tools that apply the same checks as any other access — organization, permissions, data ownership and consent.
1. ### It identifies itself, always.
A virtual assistant from the first sentence, on every channel. Several U.S. state laws require it — and “hidden” is not a setting here.
2. ### It doesn't make things up.
It answers only from what your institution approved: services, rates, schedules and protocols. If it doesn't know, it says so and hands the case to your team.
3. ### Clinical advice for your care team, never for patients.
Ámbar, our governance platform — events, social determinants, population-based and capitation contracts, prevention — includes a healthcare-specialized AI, tested with providers, that recommends to nurses and physicians how to follow each patient: which cohort they belong to, what to rule out, which risk factor to check. Patient contact involves no clinical advice of any kind: at any alarm sign, the agents hand off to a person. The clinical decision always belongs to a professional.
4. ### It doesn't memorize outside.
Zero retention at the model providers and zero training on your data. Personal and health information is hidden from the analyses and reports that don't need it.
5. ### It predicts to care, never to sell.
Predictions are computed only from your organization's data and for approved care purposes. Using PHI to push commercial offers would be “marketing” under the HIPAA Privacy Rule — it is not part of the product.
6. ### Risks on the record.
Controls mapped to the OWASP Top 10 for LLM applications (2025) and for agentic applications (2026) that don't depend on the model obeying, with risk management aligned with NIST AI RMF and ISO/IEC 42001.
## Who answers for the data.
Every legal department's first question: who is the controller and who is the processor? Your institution decides; we execute — and we're accountable.
### Your institution
Covered Entity / Controller
- Decides the purposes of processing and handles patient notices and authorizations under the laws that govern it.
- Always keeps custody of the medical record: Arbol works on the systems you already use.
- Approves every flow the agent runs and defines retention.
- Decides who on the team can access what, through role-based access control.
### Arbol
Business Associate / Processor
- Processes data only on your behalf and under documented instructions — never for its own purposes, never to sell, never to combine across customers.
- Signs a HIPAA BAA with every covered customer and a DPA under U.S. state privacy laws, before the first record is processed.
- Applies the Security Rule safeguards: encryption, least privilege, audit logging, workforce training and documented risk analysis.
- Notifies breaches without unreasonable delay (60 days at most) and gives you everything your own notification duties require.
The paperwork we sign with you
| Document | When it applies | What it covers |
| ---------------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| BAA — Business Associate Agreement | Every HIPAA-covered customer | Permitted PHI uses, Security Rule safeguards, breach reporting, return or destruction of PHI at termination. Our PHI-touching subprocessors carry downstream BAAs. |
| DPA — Data Processing Agreement | U.S. state privacy laws | Service-provider role: documented instructions only, no selling, no sharing, no cross-customer combining, obligations flowed down to subprocessors. |
| NDA for documentation | On request | Under NDA we hand over the named subprocessor list, the technical architecture document, internal policies and security-assessment summaries. |
| Data-transmission agreement | Customers under Colombian law | The Colombian DPA (Decreto 1377, arts. 24–25). Detail in the Colombia version of this document. |
## Shared responsibility.
The security of your operation depends on three parties. Here is what belongs to each.
| Area | Infrastructure providers | Arbol | Your institution |
| ------------------------ | -------------------------------------------------- | ----------------------------------------------------------------- | --------------------------------------------------------------- |
| Infrastructure & network | Run the data centers, the network and the runtime. | Chooses, configures and monitors the services. | — |
| Identity | Runs the identity service. | Configures organizations, authentication factors and permissions. | Manages its users, roles and, if used, its single sign-on. |
| Data | Encrypts and replicates storage. | Isolates per organization, minimizes, retains and audits. | Is the controller and obtains the authorizations. |
| Integration credentials | Protects the secrets infrastructure. | Encrypts, uses and isolates credentials per organization. | Obtains, enters and rotates its credentials with each provider. |
| Clinical use of AI | — | Provides the controls, the notices and the traceability. | Reviews, decides and sets its protocols. |
| Incidents | Report incidents on their platform. | Detects, contains, documents and notifies. | Notifies individuals and reports as controller. |
## U.S. legal framework.
Rule by rule: what it demands and how we comply. One architecture, built to the strictest requirement of each.
### HIPAA — Privacy, Security & Breach Notification Rules
We build to HIPAA standards and sign BAAs.
What it requires
Contact data, recordings and transcripts created on behalf of a healthcare provider are PHI. A vendor processing them is a Business Associate: it must sign a BAA, apply administrative, physical and technical safeguards, use the minimum necessary and notify breaches without unreasonable delay (60 days at most). Treatment and care-coordination communications are permitted uses; using PHI for marketing requires prior written authorization.
How we comply
We build to HIPAA standards: administrative, physical and technical safeguards, documented risk analysis and workforce training. We sign a BAA with every HIPAA-covered customer and keep BAAs with every subprocessor that touches PHI — Cloudflare included — for the complete chain of trust. Our proactive outreach is care outreach, never commercial content based on someone's condition.
### Security Rule — proposed update
Not yet law; its core proposals already run here.
What it requires
HHS proposed strengthening the Security Rule: mandatory encryption of ePHI in transit and at rest, mandatory MFA, asset inventories, vulnerability scanning and penetration testing, and fast restore of critical systems. As of September 2026 it remains a proposal.
How we comply
We aren't waiting for the final rule: encryption in transit and at rest, MFA for every user, asset inventories and continuous vulnerability management already run by design.
### TCPA and the FCC's rules for AI voices
Since February 2024, an AI voice is an “artificial voice” under the law.
What it requires
Outbound AI-voice calls require prior express consent (written for marketing), with healthcare exemptions for covered entities and their Business Associates. Consent revocation must be honored within 10 business days, and several states require all-party consent for recording.
How we comply
Self-identification at the start of every call, recording announced by default (all-party-consent standard), consent management and immediate opt-out: whoever asks not to be contacted is not contacted again.
### State AI-in-health laws — California, Utah, Texas
One rule covers them all: the agent says it's AI, always.
What it requires
California's AB 3030 requires AI-generated clinical audio to say so at the beginning and end, with a path to a human. Utah's AI Policy Act requires disclosure in health interactions, and Texas's TRAIGA requires clear disclosure when AI is involved.
How we comply
The agent identifies itself as AI at the start of every interaction, by default and with no option to hide it; extra notices are configurable per state, and there is always a path to your human team.
### State privacy — CCPA/CPRA and about twenty states
We are a service provider: documented instructions, never a sale.
What it requires
State privacy laws follow the controller/processor model: a vendor processing on a customer's behalf acts only on documented instructions, never sells or shares, never combines across customers and flows its obligations down to subprocessors. PHI is governed by HIPAA; Washington's My Health My Data covers health data outside it.
How we comply
A DPA for every customer, no selling or ad-sharing of data, and the health data we process for providers is always handled as PHI under a BAA — the highest standard available.
### Frameworks — SOC 2, ISO/IEC 27001, NIST CSF 2.0, NIST AI RMF, ISO/IEC 42001
The standards auditors check, built into the program.
What it requires
SOC 2 is an auditor's attestation against the Trust Services Criteria. ISO/IEC 27001 and ISO/IEC 42001 certify management systems for security and for AI. NIST CSF 2.0 and NIST AI RMF are voluntary frameworks. None of them is self-declared.
How we comply
A security program built on SOC 2's Trust Services Criteria and HIPAA standards, aligned with ISO/IEC 27001 and NIST CSF 2.0; AI risk management aligned with NIST AI RMF and ISO/IEC 42001. Our infrastructure runs on Cloudflare, certified ISO/IEC 27001, SOC 2 Type II and PCI DSS Level 1. Reports and attestation status are shared under NDA.
Operating in Colombia? Ley 1581 de 2012, the SIC's AI guidance and the medical-record regime have [their own version of this document](https://www.getarbol.com/legal/trust/?lang=es).
## Subprocessors.
Only the ones strictly necessary to operate, each under a back-to-back processing agreement and — where PHI is involved — a downstream BAA. The named list is delivered under NDA, and we notify you before adding or replacing any of them.
| Function | Location | Safeguards |
| ------------------------------------------------ | --------------------- | --------------------------------------------------------------------------------- |
| Infrastructure, databases & network (Cloudflare) | U.S. · global network | BAA · SOC 2 Type II · ISO/IEC 27001 · PCI DSS · one database per organization |
| Authentication & identity | U.S. | DPA · MFA · SOC 2 Type II |
| Observability | U.S. | Configured to receive no personal data · SOC 2 Type II · ISO/IEC 27001 |
| Telephony & text messaging | U.S. | DPA · HIPAA-eligible configuration |
| Voice processing | U.S. | Zero retention · no training · BAA |
| AI models | U.S. | Zero retention · no training · BAA |
| WhatsApp channel | Global | Processor under the WhatsApp Business terms · transfer documented in the contract |
| Payments | U.S. | PCI DSS · we never see full card numbers |
| Transactional email | U.S. | DPA · operational email only |
Every subprocessor that touches PHI operates under a downstream BAA — the complete chain of trust. [Request the named list, under NDA](mailto:support@getarbol.com?subject=Subprocessor%20list%20\(NDA\)%20%E2%80%94%20Arbol).
## Incident response.
No system is infallible. What can be guaranteed is what happens in the hours that follow — and every deadline below is a legal or contractual duty.
1. Hour 0
### Detect & contain
Continuous monitoring, severity classification and containment with the smallest lever that stops the impact. Everything is documented from minute one.
2. ≤ 72 hours
### We notify you
What happened, what data is involved, what we did and what's next. No euphemisms.
3. ≤ 60 days
### HIPAA notification
As a Business Associate, we notify the covered entity without unreasonable delay, with everything the Breach Notification Rule requires.
4. Afterwards
### Written post-mortem
Root cause, fixes with owners and dates, and the changes to the security program.
The architecture helps contain: a credential, an integration, an agent or an organization can each be isolated on its own, without stopping the platform.
For customers under Colombian law, the SIC's clocks are in the [Colombia version](https://www.getarbol.com/legal/trust/?lang=es).
## Due-diligence questionnaire.
The questions technical departments at clinics, hospitals and insurers ask us — with the answers we put in writing. If one is missing, we answer it in writing.
Encryption & infrastructure
How is data encrypted?
In transit, TLS 1.2 or higher on every connection, and TLS 1.3 on the interoperability interfaces that require it. At rest, AES-256, with managed, rotated keys. The credentials you entrust to each integration get an extra layer of encryption, per organization.
Where is data hosted?
In the United States, on Cloudflare's infrastructure, certified SOC 2 Type II and ISO/IEC 27001. Health data only lives in services covered by the BAA we sign with Cloudflare.
Do you run servers exposed to the internet?
No. The platform runs entirely on Cloudflare, with no servers, virtual machines or admin ports to maintain, and no internal service has a public address: only the services authorized to call it can reach it.
Are production and test environments separated?
Yes. Test environments have their own databases and credentials and work with synthetic data: real patient data never leaves production.
Access & identity
Who can see my institution's data?
Only the people your institution authorizes, with roles and least privilege. On Arbol's side, production access is restricted, justified case by case and recorded in the audit log.
Do you enforce multi-factor authentication?
Yes, for every person, no exceptions. Privileged access requires phishing-resistant factors (passkeys or security keys), and sensitive operations, such as a bulk export, ask for a fresh factor even within an active session.
Can we sign in with our institution's single sign-on?
Yes. Your team can sign in with your institution's identity provider (SAML or OIDC), and with SCIM your directory's joiners and leavers flow into Arbol: deactivating a person ends their sessions.
Can we limit access to our network?
Yes, module by module: public, restricted to your institution's networks, or private with no internet exposure.
Is there an audit log?
Yes: who accessed which record, when and from where. Available to your privacy officer on request.
Integrations
How do you store the credentials our payers give us?
Your administrator enters them in a write-only field: nobody — not your team, not ours — can read them back. They are encrypted per organization and only that provider's integration uses them, at the moment of each call.
If other institutions use the same integration, do they share credentials?
No. They share the code; each institution has its own connection, with its own credentials, limits and state.
How do you reach systems inside our network?
Through tunnels your network opens outbound, with no published addresses or open ports, and with read-only credentials when reading is enough. Your team can cut the connection at any time.
Retention, export & deletion
How long do you keep data?
Whatever your institution configures under its record-retention duties. Recordings, transcripts and contacts can be deleted from the dashboard at any time.
What happens when I delete something — or when the contract ends?
Deleted data leaves active systems within 30 days and backups within 90. At contract end you export everything (CSV or JSON), we delete the rest and confirm it in writing.
Can I take my data if I leave?
Always. Full export in open formats, free and frictionless. Your data is never hostage to the contract.
Artificial intelligence
Do you train models on our data?
No. Never. Model providers operate under zero retention and contracts that prohibit training on your data. What Arbol learns about your operation stays isolated in your organization, and you switch that on yourself.
Does data cross between customers?
Never — and not because of a software rule, but by architecture: every organization has its own database, with data ownership checked on every operation. Not to answer, not to predict, not for aggregate analytics.
Can the AI read any record?
No. The model receives the minimum context for its task — an agent confirming an appointment never receives the medical record — and acts through tools that check organization, permissions and consent, like any other access.
Can the agent use a patient's diagnosis to offer them services?
To care for them, yes — to sell to them, no. Predictions drive clinical outreach: the overdue follow-up, the pending screening, the missed appointment. That is treatment and care coordination, which HIPAA permits. Using PHI for commercial offers is “marketing” under the Privacy Rule and requires the patient's prior written authorization — it is not part of the product.
Do patients know they're talking to an AI?
Yes, from the first sentence and on every channel. Several U.S. state laws require it — and it cannot be turned off here.
What if the agent doesn't know the answer?
It says so honestly and hands the case to your team with the summary and the data already collected. It doesn't improvise clinical or administrative answers.
Does the AI give clinical advice?
Not in patient contact: the agents that talk to your patients give no clinical advice of any kind and, at any alarm sign, hand off to a person. In Ámbar, our governance platform, yes — for your care team: Consejo Clínico recommends each patient's cohort, what to rule out and which risk factors to check. The decision always belongs to the professional.
Incidents & continuity
Do you have an incident response plan?
Yes: continuous monitoring, severity classification, containment, customer notification without undue delay and a written post-mortem with root cause and fixes. The legal clocks are in the incidents section.
Backup & disaster recovery?
Backups encrypted to the same standard as live data, and point-in-time restore per organization, without touching anyone else. Recovery objectives (RTO/RPO) and the continuity plan are in the due-diligence packet.
Do you run security testing?
Continuous vulnerability management with severity-based remediation deadlines, threat-model reviews and independent security assessments. Executive summaries are shared under NDA.
How do I report a vulnerability?
Write to support\@getarbol.com. We confirm every report, triage it and follow it through to closure.
Compliance & paperwork
What do you sign with us?
A HIPAA BAA and a DPA for customers governed by U.S. law; a written agreement on data, purposes and controls before governance or medical records are switched on; an NDA for technical documentation; and, for customers under Colombian law, the Colombian data-transmission agreement. All of it before the first record is processed.
Which standards and certifications back the platform?
Our infrastructure runs on Cloudflare, certified ISO/IEC 27001, SOC 2 Type II and PCI DSS Level 1, under a BAA. Our program applies HIPAA standards and is built on SOC 2's Trust Services Criteria, aligned with ISO/IEC 27001, NIST CSF 2.0 and NIST AI RMF. Reports and attestation status are shared under NDA.
Do you give notice before changing a subprocessor?
Yes: prior notice before adding or replacing a subprocessor, with the information your own compliance filings need.
## The due-diligence packet.
For your committee, your counsel and your privacy officer. Sent in writing, at no cost.
[Request the packet](mailto:support@getarbol.com?subject=Due-diligence%20packet%20%E2%80%94%20Arbol) [Book a technical session](https://cal.com/tomas-giraldo-pdfbl9/30-min-arbol-ai-demo)
- Template agreements: BAA, DPA and NDA — and the Colombian data-transmission agreement where it applies.
- The privacy impact study for the AI system.
- The technical document “Security architecture, isolation and integrations,” under NDA.
- Recovery objectives (RTO/RPO) and a business-continuity summary.
- The named subprocessor list and their certification reports, under NDA.
- Written answers to your security questionnaire.
Related documents: [Privacy Policy](https://www.getarbol.com/en/privacy/), [Terms of Service](https://www.getarbol.com/en/terms/), [Governance](https://www.getarbol.com/en/governance/) and [Developers](https://www.getarbol.com/en/developers/).
This page informs; it is not legal advice. Contract versions prevail. Rules reviewed in September 2026.
---
**Arbol AI** — AI agents for clinics and healthcare providers: they answer and reach patients by phone, WhatsApp, SMS, email and web chat, book their appointments 24/7 and keep a record of every conversation.
- Original page:
- Book a demo: · Pricing:
- Agent index: · Support: