HIPAA, in writing.
There is no HIPAA certificate. Nobody can hand you one, including us.
What HIPAA asks for is a signed agreement, a short list of who touches your patients’ data, and safeguards you can check. Here are all three.
We sign a business associate agreement.
It comes with Pro and Practice. Read it before you pay. We sign it before your first patient visit, and you keep a copy.
It covers every recording, transcript and note Solanto holds for your practice.
Three companies. Each one signed.
When you record in Cloud mode, your patients’ information passes through these companies and no others. Each has signed a business associate agreement with us.
Amazon Web Services
Runs our servers and database, in the United States
Signed
Deepgram
Turns speech into text while you record
Signed
OpenAI
Writes the note, and keeps nothing afterward
Signed
Analytics tools never receive patient information. If this list changes, this page changes first, with the date. Last updated 27 September 2026.
What protects it.
Encrypted everywhere.
In transit and at rest, on our servers and on your devices.
Named people only.
Each has their own login and two-step sign-in, and every access is logged.
Checked every year.
A written risk assessment every year, and again whenever the way data moves changes.
Told within 72 hours.
If something goes wrong, you hear from us within 72 hours of us knowing. The law allows 60 days.
Kept in the United States.
Your practice’s data is stored in Virginia, in AWS us-east-1.
Never used to train AI.
Not by us, and not by the companies above.
Want nothing to leave the room?
Switch to Private Mode. Your iPhone writes the note itself. It stays on the device, never syncs.
Cloud mode is for everything else.
Asked before you sign.
Is Solanto HIPAA certified?
No company is. There is no government HIPAA certificate. We sign a business associate agreement with your practice, hold one with every company above, and run the safeguards on this page.
Do you sign a BAA on every plan?
On Pro and Practice. Free does not include one, so use Free to try Solanto before you record patients.
Who else sees my patients’ notes?
The three companies above, only to do the job listed, and nobody else. We never sell data, and there are no ads.
Can I take everything out, or delete it?
Export every note as text or PDF, any time, on any plan. Ask us to delete your practice’s data and we confirm in writing when it is gone.
Who do I ask?
Email aj@solanto.ai. You hear back from the person who built it.