Security and compliance

Patient information, encrypted twice and kept in Canada.

Your patients' information is encrypted on disk and again inside the database, stored in Canadian data centres, and protected by controls an independent auditor has examined.

Visit the Trust Center

Compliance

Independently audited, compliant with health privacy law.

SOC 2 Type II

An independent CPA firm examined our security controls in daily operation over several months and issued its report. Request a copy from our Trust Center.

HIPAA

We meet the safeguards the HIPAA Security and Privacy Rules set for health information, the standard many health organizations ask their vendors to meet.

PIPEDA

Canada's federal privacy law governs how we collect, use, and disclose personal information. Our privacy notice explains how we follow it.

PHIPA

Ontario's health privacy law sets the rules for how clinics and the services they rely on handle personal health information. We meet them for every Ontario practice that uses Medulla.

Encryption

Encrypted in transit, at rest, and at work.

In transit

Every connection to Medulla, from the browser plugin, the web app, or your phone, uses HTTPS with TLS 1.2 or newer. Browsers are told never to connect to Medulla any other way.

At rest

Our databases, their backups, and our file storage are all encrypted on disk.

At work

Sensitive patient information is encrypted a second time inside the database, each field on its own, with keys stored separately from the data. A copy of the database alone shows nothing readable.

How we operate

Hosted in Canada, with access only for those who need it.

Built and hosted in Canada: Medulla is built here, and patient data is stored in Canadian data centres.
No password to leak: You sign in with a one-time code sent to your email, so there is no password to reuse across sites or lose in someone else's breach.
Access is locked down and audited: Only the people who operate or improve Medulla can reach production. When they do maintenance, debugging, or support, they go through an audited access path and record why they need it. Those records are reviewed regularly, and anyone who reaches patient data without cause, even in its encrypted form, faces discipline up to termination.
Every change is checked before it ships: No code reaches Medulla until the full test suite and security scans have passed, including a check of every library we depend on for known vulnerabilities.
A team trained on security and privacy: Everyone at Medulla is trained on security and privacy when they join and on a regular schedule after that. Each of us knows how sensitive the information our clinicians trust us with is, and that protecting it is part of the job. Company laptops are encrypted and centrally managed.

For your review

Send your privacy officer to the Trust Center.

It holds our SOC 2 Type II report and our security documentation. Request access there, or email privacy@medulla.ca with a security questionnaire.

Found a security issue in Medulla? Report it to the same address and we will follow up with you directly.

Visit the Trust Center

See it on your EMR

Start your free trial.

Start your free trial and see it work on your own encounters.

Start free trial

No credit card required.

Questions

Security questions.

Is Medulla SOC 2 certified?

Medulla has a SOC 2 Type II report from an independent CPA firm. Request a copy from the Trust Center. Go to the Trust Center.

Is Medulla HIPAA compliant?

Yes. Medulla meets the safeguards the HIPAA Security and Privacy Rules set for health information.

Is Medulla PIPEDA compliant?

Yes. PIPEDA is Canada's federal privacy law, and our privacy notice sets out how we collect, use, and protect personal information under it. Read our privacy notice.

Is Medulla PHIPA compliant?

Yes. PHIPA is Ontario's health privacy law, and we meet its requirements for the Ontario practices that use Medulla.

Where is patient data stored?

In Canada. Medulla is built and hosted here, and patient information never gets pasted into consumer AI tools.

Can our privacy officer review Medulla before we sign up?

Yes. The Trust Center has our SOC 2 Type II report and security documentation. For a security questionnaire or anything else, email privacy@medulla.ca. Go to the Trust Center.