Security designed in, not bolted on.
RecordFlow handles protected health information (PHI), so the security model has to be exact, not marketing language. Here is precisely what is true today.
Your files are auto-deleted in 30 days
The records you upload and the organized output RecordFlow generates are automatically and permanently deleted 30 days after upload. This is a fixed storage-lifecycle rule, not a policy you have to remember to invoke. Download and save what you need within that window.
Encrypted in transit and at rest
Files are transferred over TLS and stored encrypted at rest using AWS Key Management Service (KMS) managed keys.
Access limited to the team handling your case
RecordFlow has no customer logins. Your records are handled only by the RecordFlow team working your case, and are never combined with another firm's records. Every request for a case's records, status, or files is checked against that case's owner before any data is returned, and a request for a case the caller does not own is refused.
Never used to train AI models
Your records are read only to organize your case. They are never used to train any AI model, by us or by our AI provider.
Processed under HIPAA BAAs
Records are processed only on cloud infrastructure covered by signed Business Associate Agreements: AWS (hosting and OCR) and Google Cloud (Vertex AI). No record is ever sent to a service that isn't covered by a BAA.
What we don't claim
RecordFlow runs on a single, shared cloud account. We don't claim a dedicated environment or physical separation per firm. Isolation between firms is enforced in software: every record request is checked against the case it belongs to before anything is returned, as described above.
Need a BAA for your firm?
A Business Associate Agreement is available on request. Email support@s2reason.com and we'll set one up for your firm.