Security and compliance built for mental health data.
Security combines independent audits, BAAs, encryption, and documented AI controls.
Independently audited. Continuously monitored.
Our SOC 2 Type I report was issued in March 2026. It covers the Security trust services criteria, with controls as of January 1, 2026, and our SOC 2 Type II audit is in progress. An independent HIPAA compliance assessment was also completed in March 2026. We sign a BAA with every customer and share our reports under NDA on request.
Who leads security.
Ryan Yannelli, our co-founder and CTO, leads security at Nextvisit. He has spent more than 15 years designing and securing infrastructure for hospital systems, universities, state agencies, law enforcement, financial institutions, and Fortune 500 companies. He has founded and exited multiple software, IT, and telecommunications companies.
We use least-privilege access and a clean desk policy. Where we can, we design our processes so that nothing critical depends on one person or one system. If Ryan is unavailable, security incidents escalate to our CEO, Dr. Faisal Rafiq, who works with an independent security and compliance partner. Our board gets a briefing on cybersecurity risk at least once a year.
Controls across the stack.
Access control
- Production systems sit on a zero-trust private network and are not reachable from the public internet
- Single sign-on is required for all internal and production access, including SSH
- Administrative access requires phishing-resistant MFA (passkeys and hardware security keys)
- Access to every system follows least privilege, is role based, and is reviewed on a schedule
- Company devices run endpoint protection, full disk encryption, and automatic patching
- All staff follow a clean desk policy
- Access is revoked when someone leaves
People
- Background checks for all employees and contractors
- Security awareness training at hire and annually
- All staff accept our security policies and code of conduct at hire and annually
Application security
- Static and dynamic application security testing (SAST and DAST), plus runtime code analysis
- Scanning of open-source dependencies and infrastructure as code
- AI-assisted review on every code change
- Annual third-party penetration testing and quarterly third-party vulnerability scans, with continuous automated testing in between
- Separate test and production environments; no patient data in non-production environments
- Attack protection for our application and APIs in production
- Web application firewall and DDoS protection
Detection and response
- Centralized SIEM with real-time threat detection and threat intelligence
- Intrusion detection with automated alerting
- AI-assisted log review that continuously flags anomalies and triages alerts
- Detailed audit logs of access and changes across our systems
- Runtime threat detection on hosts and containers
- Cloud security posture, identity risk, and vulnerability management
- Infrastructure and uptime monitoring, with a public status page
- A documented incident response plan, tested annually, with an escalation path to a named backup and an outside security partner
- We notify customers of any breach that affects their data within the time HIPAA requires
Data protection and resilience
- TLS for all data in transit and AES-256 encryption at rest
- We segregate each customer's data from every other customer's data
- Data loss prevention on company email
- Encrypted, versioned backups replicated across multiple availability zones
- A documented disaster recovery plan, tested annually, with a recovery point objective of 1 hour and a recovery time objective of 4 hours
- We review the security of each subprocessor before we use it, and every subprocessor that handles PHI signs a BAA (see our subprocessor list)
- Customers own their data and can request export or deletion at any time
Reporting a security issue
Email security@nextvisit.ai. Our vulnerability disclosure program explains what is in scope and how we work with researchers.
How we govern AI over time.
Internal evaluations are enabled by default and include transcripts and LLM traces to monitor accuracy, quality, and performance. Evaluations are separate from model training. We maintain BAAs and agreements with our AI gateways, model providers, and AI providers.
Read our AI and subprocessor disclosures for provider roles, model routing, retention, redaction, and provider restriction requests.
Clear PHI boundaries.
- Encrypted in transit and at rest (TLS 1.3, AES-256).
- As of 2026, model training on patient or provider information requires explicit opt-in.
- Third-party data, including Google Accounts, Google Calendar, and EHR data, is excluded from training.
- Configurable retention. Recordings deleted on signature.
- SSO, SCIM provisioning, audit logs.
- US-hosted on infrastructure with HIPAA BAAs.
The clinician is always the author.
AriaMD is grounded in retrieved encounter context, uses safety guardrails, and surfaces sources for every assessment. The clinician reviews and signs. The AI never owns the chart.