Security & Compliance
Built Into the Platform — Not Bolted On

The HITRUST e1 (Essential, 1-Year) assessment validates an organization against the 44 most critical cybersecurity practices identified by the HITRUST Alliance — a curated subset of the full HITRUST CSF designed to establish a verified, independently assessed security baseline. Unlike self-reported compliance, e1 requires third-party validation by a HITRUST-authorized assessor. It is a meaningful, audited credential recognized across healthcare, not a checkbox.

Documo is currently in the HITRUST e1 assessment process. Once certified, customers will be able to access the certificate directly from our Trust Center. We will update this page upon completion.

SOC 2 (Service Organization Control 2) is a framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates a vendor’s security, availability, confidentiality, and privacy controls. The critical distinction of Type II over Type I: Type II audits test whether controls actually operated effectively over an extended observation period (typically 6–12 months), not just whether they were designed correctly. A vendor can produce a SOC 2 Type I report in weeks by designing controls on paper — a Type II report requires months of demonstrated operation.

The SOC 2 Type II report is available to qualified prospects 
and customers under NDA. 

HIPAA requires covered entities and their business associates to implement three categories of safeguards to protect electronically protected health information (ePHI). Documo implements all required controls across all three categories — and provides a signed Business Associate Agreement to every healthcare account, regardless of plan or spend. We don’t treat HIPAA compliance as an enterprise-tier feature.

PIPEDA governs how private-sector organizations in Canada collect, use, and disclose personal information in the course of commercial activity. For healthcare organizations operating in Canada or exchanging patient data across the US-Canada border, PIPEDA compliance is required in addition to HIPAA.

Documo supports both HIPAA and PIPEDA requirements, with Canadian data residency options available for eligible, PIPEDA-scoped workflows. Some platform data is always processed in the United States.

Documo encrypts every document and every transmission — data is encrypted in transit and at rest across processing, storage, and delivery. Encryption is enabled by default and managed through Google Cloud’s key management infrastructure, so key protection is handled by specialists and applied consistently across the platform.

Documo runs 100% on Google Cloud Platform (GCP). This isn’t a legacy system that was migrated to the cloud — Documo was architected as a cloud-native platform from the ground up, inheriting GCP’s enterprise security controls, physical data center certifications, and global infrastructure reliability by design.

For healthcare environments where downtime is not an option, Documo replicates all customer data across regions — so in the rare event of a regional disruption, our recovery point objective stays very low. Our compute environment is defined entirely as infrastructure-as-code, so we can re-provision it in another region quickly and with minimal manual work. This keeps recovery times short and supports the 99.9% uptime commitment healthcare workflows depend on.