Security
Security your compliance team can check.
Docflow works with PHI every day, so we've had our security controls examined by an independent auditor, and we sign a BAA with every customer.
Our SOC 2 Type 1 report.
SOC 2® Type 1Docflow has received its first SOC 2 Type 1 report on its controls relevant to security, issued by independent CPA firm Prescient Assurance. The examination covered the design of our controls for access, change management, encryption, monitoring and incident response. The report is available to customers and prospects under NDA.
Request our SOC 2 reportWe'll send the report after a mutual NDA.
Built to handle PHI.
A BAA before any data moves
We sign a business associate agreement with every customer before Docflow touches PHI.
Encrypted everywhere
Data is encrypted in transit and at rest.
Every action logged
Each step Docflow takes is recorded, so you can see who did what and when.
Least-privilege access
People and automations get only the access their work needs.
Security questions.
Does Docflow have a SOC 2 report?
Yes. Docflow received a SOC 2® Type 1 report on its security controls from Prescient Assurance in October 2026. We share the full report under NDA on request.
How do we get the report?
Request it and we'll send it after a mutual NDA. Request our SOC 2 report
Is Docflow HIPAA compliant?
Yes. We sign a BAA before any data moves, encrypt data in transit and at rest, and log every action.
See it on your own workflow.
Start with a 30-day pilot, fully refundable if you're not satisfied.
This is how you try Docflow: a 30-day pilot, fully refundable if you're not satisfied.
Reserve your start week.
HIPAA compliantSOC 2® Type 1Always on, always improving