Skip to content
NewFree 30-minute AI strategy call for new clients.Book yours
SYF Tech
Let's talk
Security & compliance

Built for HIPAA and GDPR from day one.

AI, automation, web and mobile for healthcare and EU teams, with the agreements and safeguards sensitive data needs.

Talk about your project →How we protect data
Two regimes, one standard

US health data or EU personal data. We're ready for both.

US · Healthcare

HIPAA-ready builds

For US healthcare apps and AI that handle protected health information (PHI).

  • We sign a Business Associate Agreement (BAA) when we handle PHI
  • PHI encrypted in transit and at rest
  • Least-privilege access, with audit logs
  • No real patient data in development or testing
We sign · BAA
EU · EEA

Built for GDPR

For products that process personal data of people in the EU.

  • We sign a Data Processing Agreement (DPA)
  • EU client data can be hosted in EU regions
  • Encryption, access control and audit logs
  • Engineers sign NDAs and are trained on GDPR
We sign · DPA
How we protect data

Six safeguards on every regulated project.

06 safeguards
01

Encryption in transit & at rest

Data is encrypted on the wire and in storage.

02

Least-privilege access

People and services get only the access their job needs.

03

Audit logs

Who accessed or changed what, and when, is recorded.

04

No real patient data in dev

Development and testing never use real patient records.

05

Regular backups

Data is backed up on a schedule so it can be restored.

06

NDAs & training

Engineers sign NDAs and complete HIPAA/GDPR training before regulated work.

How a regulated project runs

Paperwork first. Then code.

  1. 01 / 04

    Data map & risk review

    We map which personal or health data the system touches and where it flows.

  2. 02 / 04

    BAA / DPA signed

    The right agreement is in place before regulated data reaches us.

  3. 03 / 04

    Build with safeguards

    Encryption, access control and audit logs built in from the start. No real patient data.

  4. 04 / 04

    Handover with documentation

    We hand over the system with documentation of how your data is protected, for your records.

What we sign

BAABusiness Associate AgreementUS healthcare work that handles PHI
DPAData Processing AgreementWork that processes EU personal data
NDANon-disclosure agreementSigned by every engineer on regulated projects

Compliance is shared. We build to these standards; your organisation stays responsible for its own policies. Talk to your legal team.

Handling health or EU personal data?

Tell us what you are building. We will walk you through how we would protect it.

Talk about your project