> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chartnote.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Chartnote privacy and security: HIPAA and SOC 2

> How Chartnote protects patient data: HIPAA safeguards, encryption in transit and at rest, vendor BAAs, a SOC 2 Type II examination, and no PHI used to train AI.

How Chartnote protects your data and your patients' information.

**Who this is for:** Everyone · **Plans:** All plans · **Where:** All Chartnote apps

Chartnote follows HIPAA, PIPEDA and GDPR requirements so the data we collect and process is protected at every stage.

## Our people

* All Chartnote employees undergo background checks before hiring.
* Everyone completes annual security awareness training covering HIPAA, PIPEDA, GDPR, privacy and information classification.

## Compliance and independent audits

* HIPAA, PIPEDA and GDPR compliance.
* Chartnote has completed a SOC 2 Type II examination by an independent CPA firm.
* Regular risk assessments keep our policies current.
* Our CTO oversees privacy and security.

The SOC 2 Type II report is available through our [Trust Center](https://trust.chartnote.com/).

## Secure development

* All software changes go through compliance review.
* Infrastructure is managed as code, and every change is reviewed before deployment.
* Engineers complete secure development training.

## Hosting and encryption

* All data is stored and processed in Amazon Web Services (AWS) data centers.
* We maintain a HIPAA Business Associate Agreement (BAA) and a Data Processing Agreement (DPA) with AWS.
* All data is encrypted at rest and in transit.

## Vendors and AI

* Vendors that may process patient information must be HIPAA, PIPEDA and GDPR compliant and sign BAAs, DPAs or equivalent agreements.
* Our speech-to-text and AI vendors are under BAAs with zero data retention.
* Protected health information (PHI) is never used to train AI.
* Files you attach to Copilot are removed from the AI provider after 48 hours. The conversation stays.

## Your control over patient data

* Delete notes at any time. Deleted notes and drafts go to the Trash for 30 days, where you can restore them. After that, or if you delete them from the Trash, they're gone for good.
* Set one retention policy to automatically delete notes, audio and transcripts after 1 to 90 days. It's off by default. See [Set note retention and automatic deletion](https://docs.chartnote.com/privacy-and-data/set-data-retention-policy.md).
* On a team, the Admin sets the retention policy for team notes.
* Admins can't see clinicians' notes unless the notes are shared with them.

## More information

* [Chartnote Terms of Use](https://chartnote.com/termsofuse)
* [Chartnote Privacy Policy](https://chartnote.com/privacyPolicy)
* [Chartnote Trust Center](https://trust.chartnote.com/)

Questions about security or compliance? Contact Chartnote Support through the in-app support chat or by [submitting a ticket](https://help.chartnote.com/portal/en/kb/articles/need-assistance-submit-a-ticket).

## Related articles

* [🛡️ GDPR Compliance at Chartnote](https://help.chartnote.com/portal/en/kb/articles/gdpr-compliance-at-chartnote)
* [Set note retention and automatic deletion](https://docs.chartnote.com/privacy-and-data/set-data-retention-policy.md)
* [Do I Need Patient Consent to Use an AI Scribe? (Is Verbal Consent Enough?)](https://help.chartnote.com/portal/en/kb/articles/obtaining-consent-for-using-ai-scribe-in-your-practice)

*Last reviewed: October 2026 · Applies to Chartnote 3.0*


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.