Encryption everywhere, no PHI by design, auditable AI access, and a security posture we describe exactly as it is.
Oystercatcher is built on public provider data — NPI registry, CMS datasets, Open Payments, state medical boards. We never process patient data, so there is no PHI in the platform to protect, breach, or subpoena.
Data is encrypted at rest with AES-256 using AWS KMS-managed keys, and in transit with TLS. The platform runs on AWS with tenant isolation enforced at the query layer for every organization.
Role-based access control with owner, admin, and member roles. Multi-factor authentication, with TOTP MFA enforced for administrative access. Enterprise plans add single sign-on across the major identity providers.
Every integration is OAuth — no shared credentials. Connection activity is logged. AI-assistant access over MCP is consented per user, governable org-wide by admins, and every call lands in the audit log.
We are building our control environment toward a future SOC 2 examination. We are not yet certified, and we will not imply otherwise — when the report exists, it will be here.
HIPAA does not apply, by design: Oystercatcher processes public professional data about providers — never patient data — so there is no PHI in the platform and no BAA is needed. Your compliance team can verify this directly against our data sources. See exactly what data we use.
Not yet, and we will not imply otherwise: a SOC 2 program is underway and this page will state the certification only when we hold it. The controls described here — encryption, MFA, tenant isolation, audit logs — are in place today.
Yes. Providers can opt out, and suppression applies everywhere — search, campaigns, dossiers, and exports. How we handle provider data.
Okta, Microsoft Entra ID, Google Workspace, OneLogin, and custom SAML — available on Enterprise.
Only what your admins allow: MCP access is governed by organization policy controls, every connection uses OAuth consent, and every call is written to the audit log.
Want proof first? Read an example dossier — sample data, real mechanics.