Security at Amaia

Last updated: October 2, 2026

Amaia holds sensitive clinic information: calendars, client records and treatment notes. This page lists what we do to protect it. You will find controls here, not marketing promises, and every line can be checked on a demo call.

Where the data lives

• A separate instance for every clinic. Each clinic has its own sub-server, data folder and encryption key. There is no shared database, so data leaking across clinics is not a built-in scenario.
• Encrypted traffic (TLS) between the browser and the server, on every page and every request.
• Secrets and connections (API keys, access credentials) are encrypted on the server with AES-256 and are never sent back to the browser.

Backups that prove themselves

• Automatic daily backup, fully encrypted, including photos and clinical notes, kept for 30 generations, with a copy off the server.
• Once a week the latest backup is opened and counted against what was written at backup time. A backup nobody tried to restore is a hope, not a backup. A failed check raises an immediate alert.

Who sees what

• Role-based permissions, down to the field. A front desk team member can manage appointments without seeing clinical notes. Permissions are enforced on the server, not only on screen.
• Every access to a medical record is logged (who, when, what, and whether it was approved) and kept for 24 months.
• A weekly automatic security digest summarizes failed sign-ins and unusual access. The log is not only written, it is read.
• Passwords are hashed with scrypt, repeated failed sign-ins are blocked, and idle sessions sign out automatically.

Updates and security fixes

• Every release runs an automated chain of hundreds of test scenarios, including a scan for known vulnerabilities in third-party components. A severe vulnerability blocks the release.
• Every release has an instant rollback point: if something is wrong, we return to the previous version in seconds.

If something does happen

• A written incident response procedure: contain, document, assess, and notify the affected clinic, and the authorities where the law requires it, when an incident is serious.
• Clinics receive a yearly report on how we meet our security obligations, as part of the data processing agreement.

What we do not claim

Our security program is built in line with Israel's Privacy Protection (Data Security) Regulations, 2017 and the ISO 27001 controls, but we have not yet been through an external certification audit. So we do not write "certified" or "compliant" here.

HIPAA. We are working toward HIPAA compliance ahead of our US launch, including a Business Associate Agreement. Until that work is complete, we do not describe Amaia as HIPAA compliant, and we will tell you exactly where things stand before you sign.

What is certified, with certificates: the infrastructure the system runs on. Our servers are hosted in a data center in Israel by an infrastructure provider that holds ISO 27001:2022 certification (certificate no. 1124510, valid until 11/2027) and ISO/IEC 27017:2015 certification for information security in cloud services (certificate no. 115017, valid until 11/2027), both from the Standards Institution of Israel, as well as a SOC 2 Type II (Security) report for 10/2023 to 9/2024 prepared by a Deloitte member firm, with an unqualified opinion. The certificates are available on request. Our list of sub-processors is set out in the data processing agreement each clinic approves, and we are happy to go through it on a call.

Security questions

Email asaf@amaia.health. We answer within two business days, and vulnerability reports get priority.

Documents for clinics: Terms of service · Privacy policy · Accessibility statement