Skip to main content

​
Compliance Certifications

HIPAA

Business Associate Agreement available. Full compliance with Privacy and Security Rules.

Status: Certified

SOC 2 Type II

Annual audit covering security, availability, and confidentiality controls.

Status: Certified

HITRUST CSF

Healthcare-specific security framework certification.

Status: In Progress

FDA 21 CFR Part 11

Electronic records and signatures compliance for SaMD applications.

Status: Compliant
BAA Available: Rubric signs Business Associate Agreements (BAAs) with all customers handling PHI. Contact your account manager or email [email protected] to execute a BAA.

​
Security Overview

PHI Handling

Comprehensive controls for protected health information throughout the data lifecycle.

Encryption

AES-256 encryption at rest, TLS 1.3 in transit. Customer-managed keys available.

Access Logging

Complete audit trail of all data access with tamper-evident logging.

Data Retention

Configurable retention policies with secure deletion and compliance holds.

​
Infrastructure Security

ControlImplementationDetails
Cloud ProviderAWS GovCloud / AWS CommercialRegion selection based on data residency requirements
Network SecurityVPC isolation, WAF, DDoS protectionPrivate endpoints available for enterprise
ComputeHardened containers, no persistent storageStateless application tier
DatabaseAmazon RDS with encryptionMulti-AZ deployment, automated backups
Object StorageS3 with server-side encryptionVersioning enabled, cross-region replication
Secrets ManagementAWS Secrets ManagerAutomatic rotation, audit logging
IdentityAWS IAM, SSO integrationRole-based access, MFA required

​
Data Flow Security

Ingestion → Processing → Storage → Access

1. Ingestion: TLS 1.3 encryption, API key auth, request signing
2. Processing: Isolated compute, no disk persistence, memory encryption
3. Storage: AES-256 encryption, customer-managed keys optional
4. Access: RBAC, audit logging, session management

​
Access Controls

Rubric implements role-based access control (RBAC) with predefined roles for healthcare AI workflows:
RolePermissionsTypical Users
Organization AdminFull access, user management, billing, security settingsIT administrators, compliance officers
Project AdminFull project access, team management, integrationsML team leads, project managers
EvaluatorCreate evaluations, view results, manage datasetsML engineers, data scientists
ReviewerSubmit reviews, view assigned samplesClinicians, medical reviewers
ViewerRead-only access to results and reportsStakeholders, executives
API OnlyProgrammatic access only, no UIService accounts, CI/CD
rbac_example.py
# Invite user with specific role
client.organization.invite_user(
    email="[email protected]",
    role="reviewer",
    projects=["patient-triage"],

    # Optional: Require MFA
    require_mfa=True,

    # Optional: Set session timeout
    session_timeout_minutes=60
)

# Create service account for CI/CD
service_account = client.organization.create_service_account(
    name="github-actions",
    role="evaluator",
    projects=["patient-triage"],

    # Restrict by IP
    allowed_ips=["203.0.113.0/24"]
)

​
Security Best Practices

PracticeDescription
Enable Multi-Factor AuthenticationRequire MFA for all users accessing PHI. SSO with your IdP is supported.
Use Least Privilege AccessAssign minimum necessary permissions. Use project-scoped roles when possible.
Rotate API Keys RegularlySet up automatic key rotation or rotate manually every 90 days.
Review Audit LogsRegularly review access logs for anomalies. Set up alerts for suspicious activity.
Configure Data RetentionSet appropriate retention periods for your compliance requirements.
Use Private EndpointsFor enterprise deployments, use VPC private endpoints to avoid public internet.

​
Security Documentation

Request additional security documentation for your compliance review:
  • SOC 2 Type II Report
  • Security Architecture Whitepaper
  • Penetration Test Executive Summary
  • Business Associate Agreement (BAA)
  • Data Processing Agreement (DPA)
  • Vendor Security Questionnaire (CAIQ, SIG, Custom)
Security Review: Contact [email protected] to request security documentation or schedule a security review call with our team.