Trust Center
Case files are the most sensitive data an organization holds.
Richard processes QME reports, injury narratives, and treatment records every working day. Here is how they are protected — and how to get the full documentation.
Controls
What is in place
- Access controlRole-based access, SSO-delegated MFA, scoped sessions.
- Audit loggingAppend-only at the database. Six-year retention floor.
- EncryptionAES-256 storage encryption and TLS 1.2+ client connections.
- Availability & recoveryRegional HA, daily backups, cross-region copies — restores drilled.
- Change managementCI pipeline, static analysis, secrets in a managed vault.
- Data protectionContent logging safeguards, organization-scoped access, validated uploads.
- Incident responseWritten plan, named roles, exercised in tabletop.
- Vendor managementEvery sub-processor named and reviewed quarterly.
Sub-processors
Who else touches your data
Frequently asked questions
Will you sign a Business Associate Agreement?
Yes. We offer a BAA for organizations handling protected health information whose client relationships require one. Email security@richard.law for our agreement and help coordinating your organization's requirements and account setup.
Do you train AI models on our case files?
No. Your prompts, conversations, and uploaded documents are not used to train or fine-tune models by Richard or our providers. Our AI governance page explains how content is processed to deliver the service.
Are you SOC 2 certified?
Our controls are aligned with the SOC 2 Trust Services Criteria; an independent report has not been issued. We can provide control documentation for your review. If your organization requires a SOC 2 report, contact us to discuss requirements and timing.
Are you HIPAA certified?
Richard self-attests to HIPAA Security Rule compliance, supported by documented safeguards, workforce training, a risk analysis, tested incident-response procedures, and signed BAAs with Google Cloud and Anthropic. HHS does not issue HIPAA certifications. Contact us for the documentation supporting our program.
Where is our data stored?
In the United States, on Google Cloud — region us-central1 for the database and document storage, with a disaster-recovery copy of documents in us-east1. No customer data is stored outside the United States.
What happens when we delete an account?
Account deletion is self-service, protected by a password and confirmation phrase. The account locks immediately, with a seven-day recovery window available through a one-time email link. After that, user records are permanently deleted and uploaded files are removed from live storage. Recoverable document copies age out over roughly 44 days through versioning and soft deletion. Organization deletion follows the same seven-day window; audit-linked records are handled as described below.
The security packet
Full control detail with every stated limitation, our HIPAA policy set, the incident-response plan, and our Business Associate Agreement. Answered by the engineer responsible for the controls, not a support queue — and we complete CAIQ, SIG Lite, or your organization's own questionnaire.
Posture last reviewed October 1, 2026.