Security built around medical trust
AREEP handles sensitive healthcare knowledge and conversations. Our security model is designed around tenant isolation, controlled access, and clear accountability.
Tenant data isolation
Every client's knowledge base, conversations, and settings are stored in a strictly separated tenant. No client can access another client's data — by design, not by convention.
API key separation
LLM provider credentials are managed centrally through the LLM Manager and kept separate per service and tenant. Keys are never exposed to end users or in client workspaces.
Role-based access
Workspaces use roles and permissions so users only see what they need. Admins control user creation and role assignments across the platform.
Incident tracking
Channel outages and system incidents are tracked with status and history, giving admins and clients clear visibility into service health.
Human escalation control
Sensitive and low-confidence questions are routed to human teams, never auto-answered. Humans retain final authority over patient-facing responses.
Secure deployment recommendations
We document recommended deployment practices — environment isolation, secrets management, least-privilege access, and monitoring — so your instance is hardened.
How your data is handled
AREEP stores the data required to operate: account data, conversation data, uploaded knowledge files, and usage analytics. Data is used only to provide and improve the service you're using.
- Account dataIdentities, roles, and workspace settings.
- Conversation dataMessages needed to provide context and service.
- Uploaded knowledge filesYour approved content, indexed for retrieval.
- Usage analyticsOperational metrics such as messages, tokens, and reports.
We don't overclaim
Compliance is earned with documentation and controls, not badges. If you need specific certifications or compliance reviews, contact us and we'll share the current evidence.
Transparent about certifications
We won't claim certifications we haven't earned. Ask our team for the current compliance evidence for your region and use case.
Client responsibility
You control the knowledge you upload and the answers your team approves. Our docs cover how to configure the platform safely for your workflows.
Security questions
Have specific questions about encryption, access, or deployments? Contact us and we'll walk you through the details.
Have security requirements for your organization?
Share your security, compliance, and data-handling needs and we'll review them together.