This page lists what is in place to protect patient data and which vendors touch it. Every customer signs Praktend's BAA in setup, and Settings shows the date it was signed. Each subprocessor BAA is dated below. It also states plainly which certifications Praktend holds and which it does not.
| Fact | Status | Detail |
|---|---|---|
| Customer BAA | In place | Every customer signs Praktend's BAA in setup, and Settings shows the date it was signed. The party that signs it is Silverpine Ventures, LLC (doing business as Praktend), a Colorado limited liability company. On the subprocessor side, four are executed (Google Cloud 2026-06-04, Retell 2026-07-10, Stedi 2026-07-23, Mailgun 2026-08-14) and none are pending. Twilio has no send path and SendGrid is retired. The subprocessor section lists each one and its status. |
| Subprocessor BAAs | In place | 4 signed, none pending. Executed BAAs with Google Cloud, Retell, Stedi, and Mailgun. No subprocessor BAA is pending. Each is dated in the subprocessor section below. |
| Encryption | In place | AES-256 at rest across Firestore, GCS, Cloud Run, and Secret Manager. TLS 1.2 or higher in transit on every public endpoint, with TLS 1.3 supported. |
| Hosting | In place | Cloud Run behind Firebase Hosting on Google Cloud, in the US. No on-prem hardware. |
| HIPAA | In place | Access control, audit controls, integrity, authentication, and transmission security are in force, as set out in the HIPAA section. HIPAA has no certification, and Praktend does not claim one. |
| ISO 27001 | Held by Google Cloud | Google Cloud holds ISO 27001 certification for the infrastructure Praktend runs on; Praktend does not hold its own. |
| SOC 2 Type II report | Not held | Praktend holds no SOC 2 Type II report. |
| Documents on request | On request | DPA, subprocessor list, and security questionnaire, listed in the documents section. |
| Vulnerability reporting | Published | Reports go to chris@praktend.com, the route named in security.txt. |
One login, role-scoped, MFA-capable.
Your systems stay yours. What we hold, we encrypt.
Runs on Google Cloud's audited platform.
Actions carry receipts.
Praktend is built for dental back-office operations. PHI flows through the platform on every credentialing, billing, and records task. This section describes exactly which controls are in force, which BAAs are signed, and what we do not claim.
No government body or accreditation agency issues HIPAA certifications, so Praktend never uses that phrase.
What HIPAA actually requires of a business associate is: a signed BAA with each covered entity, reasonable technical and administrative safeguards for PHI, and a breach notification procedure. Every customer signs Praktend's BAA in setup, and Praktend runs the safeguards and breach procedure described in this section, with the gaps listed under "What we do not claim" below. Several are not finished, so read that list before you rely on any control here.
Praktend's own infrastructure runs on GCP, which is a HIPAA-eligible platform with a signed BAA covering Firestore, Cloud Run, GCS, and related services. Some work runs through subprocessors outside GCP, such as Retell for voice calls; the subprocessor section lists them. The GCP HIPAA BAA was accepted via the Google Cloud Console on 2026-06-04.
These controls map to the HIPAA Security Rule's technical safeguard requirements (45 CFR 164.312).
164.312(a)(1) Access control: Per-company data isolation is enforced by backend access checks on the API routes that serve company data, and Firestore security rules deny direct client access. We do not claim that every route has been independently tested. Two-axis role model. Sessions use short-lived signed cookies, not long-lived tokens.
164.312(b) Audit controls: Structured audit log on logged agent actions and approvals. Append-only with an idempotency key; high-blast writes also record a reversal pointer. Centralized Cloud Logging on every Cloud Run service. PHI access logging is best-effort coverage, not a guaranteed row on every read and write (see "What we do not claim" below).
164.312(c)(1) Integrity: AES-256 at rest across Firestore, GCS, Cloud Run, and Secret Manager. Checksums on GCS objects. Where an answer draws on a source record, Praktend keeps a reference to that record; this is not a guarantee that every claim carries one.
164.312(d) Authentication: Sign-in is email and password, or Google sign-in. MFA is required for every company admin in production. App-layer role checks apply on every authenticated request.
164.312(e)(1) Transmission security: TLS 1.2 floor with TLS 1.3 supported, on every public endpoint via Firebase Hosting and Cloud Run. HSTS on (not preloaded). No plain-HTTP fallback permitted.
164.310 Physical safeguards: Provided by GCP. Google Cloud data centers hold ISO 27001 certification and SOC 2 reports, and Google Cloud offers HIPAA-eligible services under its BAA. No Praktend-owned physical infrastructure exists.
PHI in LLM flows: Chat and agent LLM calls route through Vertex AI on GCP (covered by the GCP HIPAA BAA). Voice calls run through Retell, whose voice agent uses a model provider behind it (OpenAI on patient lines) under Retell's BAA, which permits processing outside the United States. Retell's BAA also permits Retell to de-identify PHI and to aggregate it for its own purposes. Our BAA with you prohibits Praktend from using PHI to train, fine-tune, or improve any general-purpose or shared AI model; Retell is not bound by a matching restriction. Praktend does not call Anthropic's direct API in production.
Every customer signs Praktend's Business Associate Agreement in setup, before the team can continue, and Settings shows the date it was signed. The BAA defines how Praktend may use PHI, requires breach notification, and sets retention and return/destruction obligations.
The BAA is signed electronically in setup. For questions about it, Chris Shannon, Founder, answers on a call: chris@praktend.com.
No federal certification program exists, and Praktend does not claim one.
MFA policy enforcement for every account type is not in place; MFA is required for every company admin in production.
Guaranteed PHI access logging is not in place; coverage is best-effort, and a logging failure never interrupts a read.
Customer-managed encryption keys are not in place, so Praktend treats its PHI as unsecured PHI for breach-analysis purposes.
Workforce security training and a sanction policy are not in place.
No SOC 2 report, HITRUST certification, ISO 27001 certificate, or completed third-party penetration test of Praktend's own product is held.
Google Cloud is executed (June 4, 2026), and that same Google Cloud BAA covers Anthropic Claude and Gemini served through Vertex AI. Retell (voice) is executed July 10, 2026, Stedi (eligibility clearinghouse) July 23, 2026, and Mailgun August 14, 2026. Twilio has no send path, and a BAA is required before any is built. SendGrid, our former backup email transport, was retired on October 11, 2026 and has no send path. OpenAI is the model provider behind the Retell voice agent; it is covered through Retell's BAA, which requires Retell to bind its subcontractors to terms consistent with that BAA, and Praktend holds no direct BAA with OpenAI. The subprocessor list below is current, and the BAA obliges us to hand it to you on request.
Anthropic does not currently offer a HIPAA BAA for its direct API. This is why Praktend's own LLM calls on PHI route through Vertex AI on GCP (which is covered). Anthropic-direct is prohibited for production PHI workloads in this platform.
Third-party attestation covering security, availability, and confidentiality. Praktend holds no SOC 2 Type II report or readiness letter.
SOC 2 is an attestation from a licensed CPA firm confirming that specific controls were operational during the observation period. A Type II report covers a sustained window (typically 6-12 months) and provides stronger assurance than a Type I (point-in-time).
No auditor has reviewed the controls below.
Common criteria: Role model enforces least-privilege. Two-axis identity separates app roles from per-company access.
Communication: Structured audit log on logged agent actions and approvals. Append-only, carrying an idempotency key; high-blast writes also record a reversal pointer.
Monitoring: Centralized Cloud Logging on every Cloud Run service. Cloud Logging logs on the production cloud project are kept at least 365 days.
Control activities: Production changes run CI and pre-commit checks; the pre-commit hooks scan for secrets and PII. Branch protection does not require a passing status check or reviewer approval to merge.
Availability: Cloud Run scales to zero and up automatically. Static assets on Firebase Hosting CDN. Uptime monitoring active.
Confidentiality: AES-256 at rest across Firestore, GCS, and Secret Manager. TLS 1.2 floor, with TLS 1.3 supported, in transit on every public endpoint.
Privacy: Customer-facing retention and deletion controls are not in place. PII scanner on every commit. BAAs are executed with our core infrastructure subprocessors (see the subprocessor list on the Trust Center); one subprocessor's downstream model provider has no BAA today.
Google Cloud Platform holds ISO 27001, ISO 27017, and ISO 27018 certifications covering the infrastructure Praktend runs on, valid 2025-2028. Praktend relies on these controls for its own infrastructure, which runs on GCP; subprocessors outside GCP, such as Retell for voice, are not covered by them. Praktend itself does not hold a direct ISO 27001 certificate.
ISO 27001 is a certification for an organization's information security management system (ISMS). When a cloud provider like Google holds ISO 27001 for its data center infrastructure, compute, storage, and networking layers, workloads running on that infrastructure operate on a certified platform. A direct ISO 27001 certificate would require Praktend to scope its own ISMS, engage an accredited certification body, pass a Stage 1 and Stage 2 audit, and maintain the certification through annual surveillance audits.
The physical and infrastructure layers under Praktend's application have been audited by an accredited body. Praktend's application-layer controls are what a Praktend-direct audit would additionally cover.
ISO 27001:2022: Information security management systems. Covers the core ISMS controls for Google's infrastructure and operations. Certificate held by Google LLC.
ISO 27017:2015: Code of practice for information security controls based on ISO 27002 for cloud services. Cloud-specific guidance including virtual machine isolation and shared infrastructure responsibilities.
ISO 27018:2019: Code of practice for protection of personally identifiable information (PII) in public clouds. Relevant to how GCP handles customer data it processes.
Praktend application layer: A direct Praktend ISO 27001 certificate would additionally cover application-layer controls, the Praktend ISMS, and organizational policies. Praktend does not hold one.
Data isolation: Per-company isolation enforced by backend access checks at the middleware layer; Firestore security rules deny direct client access. Cross-company reads raise a security violation.
Secrets management: Per-tenant credentials and OAuth tokens live in a per-tenant KMS-encrypted vault; platform-level secrets live in GCP Secret Manager. Pre-commit hooks block any committed secret. No credentials in code, config, or environment files checked into the repo.
Change management: Branch-protected main. All changes ship through CI and pre-commit checks (PII scanner and secret detection on every commit). Branch protection does not require reviewer approval or a passing status check to merge.
GCP ISO 27001 compliance page: Google's official documentation with certificate download links.
The vendors behind Praktend, grouped by who carries the contract. Group A is our own subcontractors, where we owe you a BAA and we say plainly which ones are signed and which have no send path or are retired. Group B handles no protected health information by design. Group C is your own vendors, which you contract with directly and we never sign for. If you believe a vendor is missing from this list, tell us and we correct it.
Primary PHI store and compute. Firestore, GCS, Cloud Run, KMS, Secret Manager, Logging, BigQuery, Document AI, speech services. Also covers Praktend's own self-hosted browser runner.
Mail, calendar, and drive on Praktend-provisioned mailboxes. Your own Workspace tenancy is a separate arrangement and sits in group C below.
Claude models for agent reasoning, reached through Google Vertex AI Model Garden and covered by the Google BAA. Anthropic does not offer a BAA for its direct API, so the direct API is not used for protected health information in production.
Hosted model inference for agent reasoning, embedding, and transcription. Google confirmed in writing on 2026-06-04 that Claude via Model Garden falls under the customer's GCP HIPAA BAA. There is no separate Vertex instrument.
Eligibility clearinghouse on Praktend's own account, and the default path for insurance verification. Every 270 and 271 exchange carries patient name, date of birth, and subscriber or member ID.
Voice AI for patient and payer phone work, and the default voice provider since 2026-07-13. Call audio, transcripts, dates of birth, and member IDs pass through it. Retell's voice agent is configured with an OpenAI model, which Retell's BAA covers: Retell must bind its subcontractors to terms consistent with that BAA. Praktend holds no direct BAA with OpenAI. Retell's BAA permits it to process PHI outside the United States, to de-identify PHI, and to aggregate it for its own purposes.
Primary outbound transactional email and the inbound reply webhook. Nothing structurally prevents a person or an agent from putting health information in an email body, so we treat it as PHI-capable.
Not in use for patient messaging: no SMS send path exists, and a BAA is required before one is built. Twilio is the carrier behind the front-desk voice lines, so it is an indirect subcontractor of Retell there. Praktend holds no direct BAA with Twilio.
Retired 2026-10-11. No send path remains, and no BAA is obtainable because Twilio's HIPAA-eligible services list excludes SendGrid.
Subscription billing and card processing for your Praktend invoice. Card details go to Stripe directly. Praktend does not store card numbers, and no patient data is sent.
Read-only bank connections for bookkeeping workflows. Used only when you connect a financial account. No patient data is sent.
Scheduling for sales demos and onboarding calls with Praktend. Business contact details only. It is not connected to any patient schedule.
Bot protection on login and public forms. Sees request metadata and browser signals. No patient data is sent.
Your practice management system. Praktend reads your Open Dental data through the Open Dental API or your practice's own read-only exports, and holds no Open Dental data account of its own.
Call tracking on your own CallRail account. Praktend holds no CallRail account and makes no CallRail API calls. It reads the notification emails CallRail sends to your mailbox. Standard CallRail plans prohibit PHI, so the healthcare tier matters here.
Your phone system. Praktend reads call audio, transcripts, voicemail, and SMS from your own account over OAuth. Default RingCentral plans are not BAA-covered, so the HIPAA-enabled plan matters here.
Your own mailbox and Drive. Praktend reads them over per-tenant OAuth that you can revoke at any time. No new vendor is introduced into the flow.
The BAA is signed in setup. For the other documents, send a note and we send the document or schedule a call to walk through it. Procurement teams welcome - send your CAIQ, SIG, or custom questionnaire and we return it within five business days.
Request a document →Business associate agreement. Every customer signs it in setup, before the team can continue, and Settings shows the date it was signed. The HIPAA section lists what it covers and the gaps we have not closed.
Data processing addendum for regulated data flows or international processing requirements.
The live version of the Subprocessors section, with effective dates and contract status.
CAIQ, SIG Lite, or your custom format. Answered with citations to controls above.
Report a security issue to chris@praktend.com. The published route is security.txt.
The gaps we know about, named directly. Reach out anyway, and we tell you straight.
Praktend holds no SOC 2 Type II report.
Praktend does not hold its own ISO 27001 certificate. The underlying GCP platform is certified to 27001, 27017, and 27018. Praktend itself is not.
Twilio has no SMS send path today, and a BAA is required before any patient SMS is built. SendGrid was retired 2026-10-11 and no BAA is obtainable for it. Mailgun, the primary email provider, executed its BAA 2026-08-14. The subprocessor section marks each one. We would rather you read it here than find it in diligence.
Google Cloud and our clearinghouse have their own tested and attested platforms. Praktend's application has not had an independent penetration test.
There is no live uptime dashboard and no contractual SLA today. Incident and maintenance notices go out by email. Vulnerability reports have a published route at security.txt.
Alerts go to the team directly. Response is human, not an on-call rotation. If you require a staffed SOC contractually, that is not the current shape.
Praktend is a small-team operator with an AI workforce, not a Fortune-500 vendor with a binder.
An annual risk assessment with assigned owners is not in place.
Quarterly access reviews and formal offboarding procedures are not in place.
Annual third-party security assessments are not in place.
Automated daily backup is not in place; your practice management system remains the system of record.
Alerts on anomalous privileged actions are not in place.
A documented rollback runbook for every deployed Cloud Run service is not in place.
A contract-time security review of each subprocessor is not in place.
A written business continuity plan with an annual tabletop exercise is not in place.
Each department comes with its own AI assistant, and the AI chief of staff hands every request to the right one.
Built into every plan: shared inbox, IT & security, practice knowledge.
Send your BAA, your questionnaire, or your specific requirement. Reply within twenty-four hours.
Book a 15-minute demo