Security
What your security review will ask.
Written to be forwarded. If something here is not settled, it says so rather than being left out — an omission reads as an answer, and this is not a page to be clever on.
A PDF of this page is available on request. Half the people reading it are forwarding it to someone else, and making them screenshot a web page is a small daily tax on every deal.
Not yet settled — 2
These two block a signed BAA and we are not going to write a sentence here that we cannot put in a contract. They are the first things being resolved.
- Where is US customer PHI processed and stored?
- Does the Chennai team access production?
Contracts and compliance
- Will you sign a BAA?
- Yes, with every customer, and we hold one with every subprocessor. Request it with the pilot and it comes back the same week.
- Are you HIPAA certified?
- Nobody is — HIPAA certification does not exist. Bolo is built for HIPAA workflows and a BAA is available. Any vendor claiming certification is telling you something about their diligence.
- SOC 2? In progress
- Type II is in progress. Current status, including what is and is not in scope, is available on request. We will not put a badge on this page before the report exists.
Where the data lives
- Where is US customer PHI processed and stored? Not yet settled
- This is not settled and we are not going to write a sentence here that we cannot put in a contract. The engineering intent is US-region processing and storage only, with no exceptions and no “just for debugging”. Until the legal structure between Bolo Labs Inc. and Voxaura Labs Pvt. Ltd. is finalised, ask us directly and you will get the current answer in writing.
- Does the Chennai team access production? Not yet settled
- Same open question, and the honest answer is the same one. The intended design is that the Chennai team works on synthetic and de-identified corpora only, and that production PHI access either requires named individuals with a logged break-glass path or does not exist at all. Which of those it ends up being changes the answers to your questionnaire materially, so we would rather resolve it than describe it.
- Do you train on our PHI?
- No. Model training uses licensed and consented corpora. This is a contract term, not a marketing sentence — ask for the clause.
Controls
- Encryption
- TLS 1.3 in transit. AES-256 at rest with customer-scoped keys.
- Access control
- Role-based, minimum-necessary, with break-glass access logged and reviewable by you.
- Audit logging
- Immutable, write-once log of every PHI read and write. Available to the customer, not just to us.
- Retention
- Audio defaults to 30 days and is customer-configurable, with a hard ceiling stated in the contract. Transcripts follow your record-retention policy, since they may become part of the medical record. Derived embeddings are purged with their source. Deletion is real deletion and propagates to backups within the stated window.
Consent and recording
- How is recording consent captured?
- Spoken, in the patient's own language, timestamped and stored in a consent registry keyed to the patient. Not a checkbox in English on a relative's phone.
- What about all-party-consent states?
- The session checks the registry and the jurisdiction before capture begins, and refuses to record if either is missing. Roughly a dozen states require all-party consent — California, Illinois, Florida, Pennsylvania, Washington and Massachusetts among them.
- Can a patient withdraw consent?
- Yes, and withdrawal purges the recording.
- Outbound calls and TCPA In progress
- Prior express consent for automated follow-up contact is captured at intake, per patient, and revocation is honoured immediately. Counsel review precedes the first outbound campaign.
Clinical safety
- Is any of this a medical device?
- Front Desk and Scribe sit as administrative and documentation tools. Follow-Up is deliberately kept on the safe side of the line: it delivers approved information and escalates, and does not analyse patient-specific data to produce a recommendation. The positioning is documented formally and revisited with counsel if the product ever starts to reason about symptoms.
- Are you a replacement for our interpreters?
- No, and we will not be sold as one. Bolo is not a certified medical interpreter and must not be used as one for consent, procedural or other high-stakes conversations. It reduces routine interpretation load. That distinction is a line we draw explicitly, because getting it wrong is a patient-safety problem before it is a commercial one.
Subprocessors
A dated subprocessor list is maintained and provided with the BAA. It is not published here yet because the infrastructure decisions above are not final, and a stale subprocessor list is worse than none.
Reporting a vulnerability
Report a vulnerability to security@bololabs.dev. We will acknowledge within two business days and will not pursue anyone acting in good faith.
Pilot
Book a pilot call.
Thirty minutes. We will run the demo on the languages your panel actually speaks, show you the eval methodology, and tell you plainly which parts are not ready. If we are not a fit we would rather find out on this call.
One reply from a person. We do not run a nurture sequence and we do not share your address.