Security, compliance, and privacy is the number one priority at X2AI. Naturally, we are HIPAA-compliant, and have engineered our architecture to handle sensitive information from the ground up, meaning that we vastly-exceed regulatory specifications in most areas. We ensure that you are kept completely safe, secure, and invisible to others.
Security is an evolution, and not just something that is installed. We constantly update our threat profiles, patch our software, and regularly penetration-test our servers. Our philosophy is to assume a breach; thus we implement an aggressive defense-in-depth security strategy that includes everything from effective password hashing to complex countermeasures. It is important to remember that compliance does not imply security; good security is always compliant.
We secure all data in transit via TLS, and use the latest technology to ensure data security. The independent SSL audit authority Qualys has rated our servers A+, and our HTTP (security) headers have been rated A. We also allow patients to access our AI via Tor, allowing effective cloaking of IP address and DNS information. We encrypt all data with at least 256-bit asymmetric or 4096-bit symmetric keys, and backup around the planet. Scroll down for more details.
SECURITY PROTOCOL
Below you will find details of our security protocol and adopted standards that have been cleared for public release for the sake of transparency.
- X.509 / TLS (SSL IS OLD TLS)
- SERVER ACCESS
- FIREWALL POLICY
- CREDENTIAL MANAGEMENT
- PHYSICAL SECURITY ELEMENTS
- DATA DELETION
All PHI that is no longer required for the intended and agreed upon scope is deleted immediately and securely (i.e. not by conventional means). For secure printed data deletion, we enforce the use of a Security Level P-5 shredder, although documents with a high sensitivity are incinerated. For secure data deletion (i.e. at least US DoD 5220.22-M) we use a combination of shred, scrub, and encrypt and forget methods, depending on the use-case. In any case, rm is disabled.
- MX (EMAIL) SECURITY
FAQ
Below are the answers to common concerns we've heard from patients, psychologists, and lawyers.
ARE YOU HIPAA-COMPLIANT ?
Yes, so long as you are on X2AI's network. This includes x2.ai, tess.ai, and karim.ai, but does not cover any communication through third-party channels, such as SMS, Facebook Messenger, and WhatsApp (Signal by Open Whisper Systems is the only exception to this rule). Our servers that handle patient health information are dedicated. For more information, please refer to part 160, part 162, and part 164 of the United States Code of Federal Regulations.
DO YOU COMPLY WITH DATA PROTECTION REGULATIONS?
DOES THIS SERVICE COMPLY WITH ESTABLISHED STANDARDS?
CAN YOU INTEGRATE WITH OUR EHR ?
ARE MY CONVERSATIONS ANONYMOUS ?
ARE YOU ABLE TO KEEP PATIENT DATA WITHIN THE EU ?
CAN I CONNECT TO ONE OF YOUR SERVERS ?
HOW CAN I TELL IF I AM LEAKING INFORMATION ?
Use our Brief Exposure Check, safe in the knowledge that your data will not be collected. Be careful with websites offering similar checks, many harvest your information. Remember, this data is a best guess, and can vary from browser to browser.
