Evidence for
your IT review
Technical and organizational controls proportional to risk. Data flow, subprocessors, retention and processing region are confirmed in the documentation for each deployment.
The fundamentals
- ENCRYPTION AT REST DATA · DOCUMENTED FLOWDATA FLOW
Documented per deployment
The processing region and any international transfer vary according to the feature and the contracted subprocessors. The applicable flow is documented for review under the LGPD.
- DATA LIFECYCLE
Distinct categories
Audio, transcription, draft, final report, metadata, logs and backups have their own lifecycles. Processing or transmitting does not necessarily mean persisting.
- ENCRYPTION
In transit
The public policy states encryption in transit. Additional controls are listed in the technical documentation, without promising an algorithm or certification not proven here.
- AUDIT
Relevant events
Audit logs support investigation and governance. The available scope, retention and export depend on the product and the contract.
- TEMPLATES
No training on identifiable data
Identifiable care data is not used to train general models from Laudos.AI or third parties.
- ACCESS
Shared responsibility
Access control, logical segregation and permission reviews make up the protection. The institution must also govern accounts, roles and credentials.
The documentation lets you assess the applicable design before deployment.
The data's path, from dictation to report
Audio, intermediate transcription, draft, final report and metadata are distinct categories. Transmission, persistence, logs, retention and backups depend on the feature and the contracted configuration.
The technical documentation identifies the data required, purposes, subprocessors, regions, controls and periods applicable to the contracted module. This assessment must take place before real care data enters the flow.
For your DPO
- DOCUMENTATIONArchitecture, controls, subprocessors, regions, retention and data flow
- LEGAL BASISDefined by the controller according to purpose and context
- TRANSFERAssessed per service and subprocessor, with no generic promise of residency
- ROLEController for its own data; processor for care data processed under instruction
- REQUESToi@laudos.ai, subject "Security documentation"
Direct questions
Do you answer security questionnaires?
Yes. IT and the DPO can request documentation and send additional requirements for assessment before deployment.
Who are the subprocessors?
The public policy identifies categories and examples. The deployment documentation presents the applicable list, the function and the processing region.
Are audio and transcription always discarded immediately?
We do not make a universal promise. Processing, transmission, database persistence, retention in logs and presence in backups depend on the contracted feature and configuration.
What if Laudos.AI has an incident?
The team assesses each event and communicates according to risk, impact, the LGPD and the contract. The status page does not prove uptime between checks.
The design behind the audit answers
Security here is not a list of certifications. Each feature has a documented flow. Audio, transcription, draft, report, logs and backups are distinct categories. Regions, subprocessors, persistence and retention vary by the contracted configuration.
Controls include role-based access, logical segregation, auditing and encryption in transit. Events and audit-trail retention vary by module and deployment.
What your DPO will ask, and the answers
The documentation identifies the controller, processor, subprocessors, regions, purpose, persistence, retention and backups. Some subprocessors may process data outside Brazil. Identifiable care data does not train general models from Laudos.AI or third parties.
How to run the security due diligence
Questions that need a documented answer
Before approving, the institution needs to locate six items. They are: data flow, processing residency, retention per artifact, access roles, applicable subprocessors and the incident response process. The public page summarizes the design; the IT and DPO due diligence receives the detailed material and records any specific condition of the institution's environment.
Do not presume a commitment from a marketing phrase. This applies to certification, recovery time, security testing and availability. When one of these items is a requirement, demand scope, date and obligation in the assessment package or in the contract. Treat what is not documented as an open item, not as an implicit promise.
Less retention, smaller surface
Deployment separates audio, intermediate transcription, draft, final report, metadata, logs and backups. Each category has its own purpose and lifecycle. We do not presume immediate disposal or a single region for every feature. The contracted documentation defines the applicable flow.
Bring your security team into the conversation
The IT and DPO review is part of the deployment process. The documentation arrives before the first meeting.
FAQ
Questions and answers
Where is care data processed?
The flow depends on the contracted feature. Some subprocessors may process data outside Brazil. The institution and Laudos.AI confirm regions, transfers, subprocessors, retention, logs and backups in the deployment documentation. Regulatory compliance
Is the dictation audio stored?
There is no single answer for every feature and configuration. The contract and the deployment documentation must separate processing, persistence, logs, retention and backups of audio, intermediate transcription, draft and final report. Privacy policy
Does patient data train models?
Identifiable care data is not used to train general models from Laudos.AI or third parties. The processing needed to deliver the contracted feature is a different purpose and must be stated in the applicable documentation. Clinical governance
Is there an audit trail per exam?
Controls include audit logs proportional to the feature. Before production, the deployment team validates the events, content, retention and availability of the audit trail for the contracted module. Auditable log