Enterprise-Grade Security & Compliance
A public-data-only architecture with governed cloud delivery, source lineage, and procurement-ready controls.
No PII by default
The estate uses public context layers only; no patient-level source files, no claims PHI, and no proprietary customer data required.
No patient data required
The standard architecture is HIPAA-compatible because delivered products are public biomedical reference datasets, not covered PHI.
Customer data stays customer-owned
Customers keep internal data in their own warehouse and join it under their own governance controls.
Secure warehouse-native access
BigQuery IAM and Snowflake role-based access keep data in authorized environments.
BigQuery IAM controls
Access is managed through Google Cloud IAM, dataset permissions, audit logs, and customer-controlled project boundaries.
Google Cloud MarketplaceSnowflake role-based access
Native shares are governed with account-level authorization, roles, grants, and warehouse-local query controls.
Snowflake MarketplaceProcurement-ready documents
Legal, security, and procurement teams can review public summaries before contracting.
Privacy Policy
Business contact data, demo requests, and website privacy practices.
Review document →SLA
Provisioning, refresh, support response targets, and service exclusions.
Review document →Data Processing Agreement
Processing roles, data categories, security measures, and subprocessors.
Review document →BAA
Business Associate Agreement availability and PHI scope notes.
Review document →Data lineage and version control
Every row is traceable to source authority, ingestion batch, transformation logic, and refresh metadata.
Every context layer traceable to source authority
Ingestion metadata tracked for each refresh
Version history maintained for labels, schemas, and curated mappings
Validation exceptions surfaced for customer review