Built for regulators, not just demo days.
Every Adjudo decision is encrypted, audited, and cryptographically signed — by construction, not by policy memo. Here's how.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest. Per-tenant encryption keys, rotated quarterly. KMS-managed (AWS KMS / HashiCorp Vault on-prem).
Signed by construction
Every adjudication writes an HMAC-SHA256-signed audit row, hash-chained to the previous row. Tampering breaks the chain. UPDATE / DELETE are revoked at the database role.
Cloud or on-prem
Hosted in AWS ap-south-1 (India). Single-tenant VPC available. NABH-bound hospitals can run a full air-gapped install on a single GPU appliance.
Least-privilege access
SSO via SAML / OIDC. Role-based access with row-level security on Postgres. All production access goes through short-lived credentials and bastion hosts. Customer patient data is never accessible to engineers without a logged JIT request.
Audited end-to-end
Every API call, every model inference, every reviewer decision is logged with prompt SHA-256 and model version. Logs retained for 8 years to meet IRDAI requirements.
No training on your claims
We never train on customer data without explicit opt-in. If you opt in to a custom fine-tune, training runs in your tenant on your data, and the weights stay yours.
We'd rather under-promise on certifications than over-promise. Here's exactly where we are.
Vendors with potential access to customer environments. Patient data never touches the marketing-site stack.
| Vendor | Purpose | Region |
|---|---|---|
| AWS | Primary cloud (ap-south-1) | India |
| Lambda Labs | GPU compute for inference | India |
| Brevo | Transactional email (waitlist, alerts) | EU |
| Vercel | Marketing site hosting (no patient data) | Global edge |
| Cloudflare | DDoS / WAF | Global edge |
Security researchers — please report findings responsibly. We don't run a paid bounty yet, but we acknowledge every valid report and credit researchers in our hall of fame.
- Email security@adjudoai.com (PGP key on request)
- Response within 2 business days
- Triage and remediation timeline shared within 7 days
- Please don't access patient data you aren't entitled to