How we protect information

What we never take

We use the HIPAA Safe Harbor identifier list as the baseline, extended to cover financial identifiers. Any field in these categories is excluded from every extract, every report and every system we run.

What we do take: Transaction amounts, general ledger codes, posting dates, aggregate totals, and reference keys that do not point back to a person.

Before anything moves we walk through each system with you, produce a field inventory, and write an exclusion schedule that states exactly which fields we will read and which are outside our reach. Nothing is extracted until a named security or compliance contact on your side approves that schedule in writing. It is reviewed on a schedule and whenever a source system changes.

How data reaches us

We use the least invasive method the source platform supports, in this order.

1. Scheduled delivery of a filtered report. The source system produces a report with the restricted fields already left out, delivered on a schedule over an encrypted connection. Nothing restricted exists in the file at any point.
2. An interface with an explicit field list. Where the platform has an API, we request only the fields we are approved to receive. The list is written in code and documented, so what we can retrieve is fixed and auditable.
3. Automated retrieval with the fields removed before upload. Where a platform supports neither, an automated process on a machine we control signs in, retrieves the file to local storage, removes the restricted columns there, and uploads only the sanitized file. The raw file never reaches cloud storage and is purged on a schedule. No person handles it.
4. By hand. Only where the first three are impossible, under the same exclusions, with named people and a handling log. We treat it as temporary and work to replace it.

Automation and AI tools

We automate analysis and reporting. Three rules govern it. No restricted data is sent to any AI service, which follows from the exclusions above rather than from a setting someone might forget. Where an automated process reads a data source directly, the excluded columns are declared in code before any query runs. And we assume anything sent to a third party service may be retained, whatever its settings say, because the architecture is built so that assumption costs nothing.

One consequence worth stating plainly: because no health information reaches these tools, no AI provider becomes a business associate of yours through us.

Access and credentials

• Credentials sit in a vault behind multifactor authentication, reachable only by the process that needs them.
• Automated processes authenticate from a single assigned address, so valid credentials alone are not enough to sign in from somewhere else.
• Each automated process has its own credentials, separate from any person, so its activity is attributable and can be switched off on its own.
• Multifactor codes are delivered into the controlled environment, never to a personal device.
• Staff outside the United States never hold credentials to a client's systems. They work only with sanitized extracts.
• Credentials can be revoked or rotated at the vault, which closes every downstream path at once.

Storage and retention

• Only sanitized data is stored in any cloud environment we operate.
• Raw files retrieved by automated local retrieval stay on local storage and are purged once the sanitized extract is confirmed.
• Working data is kept for as long as the deliverable requires, then removed on an automated schedule.
• We keep no archive of customer level data.

Retention for information collected through this website, which is a different and much smaller question, is set out in the privacy policy.

Who processes data for us

These are the providers behind this website and our own office. Client engagement systems are agreed with you and named in the engagement, not here.

We rely on the data protection terms each publishes, including the Standard Contractual Clauses they incorporate. If we add a provider that touches personal information, this page changes and the date below changes with it. Ask at compliance@pptcgroup.com to be told when that happens.

This website

• Served only over an encrypted connection, with a strict content security policy that limits what the page may load and where it may send anything.
• We set no cookies of our own. Analytics is cookieless and can be switched off.
• The booking calendar is Microsoft's, and nothing is requested from Microsoft until a visitor chooses to load it.
• The message form is protected against bots, and messages are delivered by email rather than stored in a database we run.
• No accounts, no passwords, no payments, and no customer data of yours lives on this site.

If something goes wrong

We keep a record of every incident, whether or not it is reportable. Where personal information is exposed and there is a real risk of harm, we notify the people affected and the relevant authority without undue delay: within 72 hours of becoming aware where the UK or EU rules require it, to the Office of the Privacy Commissioner of Canada and, in Quebec, the Commission d'accès à l'information, and in Texas without unreasonable delay and within 60 days. Where we act for a client, we tell the client first and quickly, so they can meet their own obligations.

Reporting a problem

If you find a security problem on this site or in anything we run, write to compliance@pptcgroup.com with enough detail to reproduce it. We will acknowledge within two business days and tell you what we are doing about it. Please give us a reasonable chance to fix it before publishing, and please do not access or change anyone else's data while testing. We do not run a paid bounty, and we will not pursue anyone who reports something in good faith under those terms. The same address is published at /.well-known/security.txt.

What we claim, and what we do not

We will sign: a business associate agreement where you are a covered entity under HIPAA, and a data processing agreement where you need one. The exclusion design above is what makes both straightforward rather than a leap of faith.

We do not claim: a SOC 2 report, ISO 27001 certification, or HIPAA certification, which does not exist as a thing anyone can hold. If a review needs an independent audit report, ask us: we would rather tell you what we have than let a logo imply something untrue.

We welcome review of the full data handling protocol by your compliance and legal advisors, and we will adjust the design to meet a standard you have to apply. Ask at compliance@pptcgroup.com.