Security & privacy, stated precisely.

Certification requires a scoped information security management system, documented risk treatment, operating controls, internal review, and an audit by an accredited certification body. We will publish a certification claim only after that process is complete.

A SOC 2 examination is performed by an independent CPA firm against the AICPA Trust Services Criteria. Our intended path is control scoping, evidence collection, a readiness assessment, remediation, and then an independent examination.

Our privacy notice describes roles, data categories, purposes, legal bases, international transfers, retention, and individual rights. Full operational compliance also depends on maintained processing records, processor contracts, transfer safeguards, request workflows, security controls, and impact assessments where required.

Our privacy notice describes applicable rights and states that we do not sell personal information for money or share it for cross-context behavioral advertising. Applicability, request operations, vendor terms, risk assessments, and audit duties must be reviewed as the business and California rules evolve.

Do not submit PHI unless NORTH 28 has expressly approved the use in writing and the required business associate agreement is in place. HIPAA support would require a documented risk analysis, administrative, physical, and technical safeguards, appropriate vendor BAAs, training, incident procedures, and ongoing evaluation.