Security & Compliance

Healthcare-grade security

Healthcare-grade security isn't optional — it's foundational. Auxtri was built with compliance as a design requirement, not a retrofit.

Security at a Glance

Key compliance and security facts for IT and security review teams.

HIPAA Compliant

BAAs available for covered entities and business associates

SOC 2 Audit

In progress through Delve — documentation available on request

Azure Hosted

US data centers with 99.9% uptime SLA

Financial Data Only

We never process or store PHI — only AP financial records

Encrypted End-to-End

AES-256 at rest, TLS 1.2+ in transit across all data pathways

Zero PHI Exposure

Architecture explicitly scoped to exclude patient health information

Microsoft Entra ID

Identity management through Entra ID, the standard for healthcare enterprise identity

Single Sign-On (SSO)

SAML 2.0 SSO supported — no separate credential management required

VNet Isolation

All services deployed within a private Azure VNet — no public-facing internal endpoints

Role-Based Access

Granular RBAC follows least privilege — users see only what their role requires

MFA Required

Multi-factor authentication enforced for all administrator and privileged access

Full Audit Logging

Every data access logged with timestamp, user context, and query scope

Data Handling

Financial data only. Zero PHI.

Auxtri's data model is deliberately narrow — we only process what AP automation requires.

Data Auxtri processes

  • Invoice numbers and amounts
  • Purchase order references
  • Payment amounts and dates
  • Vendor contact information
  • Vendor email content (for inquiry parsing)
  • ERP invoice and payment status fields

Data Auxtri never processes

  • Patient names or identifiers
  • Medical record numbers
  • Diagnosis or procedure codes
  • Clinical data of any kind
  • Insurance member information
  • Any Protected Health Information (PHI)

Auxtri connects to your ERP with read-only access to AP financial records. It does not connect to clinical systems, EHRs, or any systems that contain PHI.

ERP Security

Read-only. Structured. Audited.

Auxtri's ERP integration is designed to be the least-privileged connection possible.

Read-Only ERP Access

Auxtri connects to your ERP with read-only credentials scoped to AP invoice and payment data. No write access is required or granted.

Structured Queries Only

All ERP data retrieval uses structured API calls or parameterized queries. No raw SQL or unstructured data access.

No Raw Email to ERP

Vendor email content is processed by Auxtri's AI layer and never passed directly to your ERP. Data flows are strictly controlled.

Full Audit Logging

Every ERP data access is logged with timestamp, user context, and query scope. Logs are retained and available for security review.

Questions about security?

Our team is happy to answer security and compliance questions, provide documentation, or connect you with our security review resources.