Security & HIPAA
Your medical bills are sensitive. We build like it.
Encryption
Data is encrypted in transit and at rest, with field-level encryption for direct identifiers.
PHI minimization
Error detection runs deterministically without sending your bill to any third-party model. When AI reasoning is used, identifiers are removed first.
Private file access
Uploaded bills live in private storage and are served only to you through short-lived, access-controlled links.
Audit logging
Access to your data and privileged actions are recorded in an immutable audit trail.
Your data, your control
Export a full copy of your data or permanently delete your account at any time.
Least privilege
Role-based access, rate limiting, input validation, and security headers throughout.
An honest note on HIPAA
BillGuard is architected to be HIPAA-conscious and compliance-ready. Full HIPAA compliance is an organizational program — signed Business Associate Agreements with every vendor that touches protected health information, a formal risk assessment, and written policies — that we complete before handling protected health information at scale. We describe our posture plainly rather than overstating it.