Trust & Security

Agreements we sign

We sign the agreements that regulated and data-sensitive clients need, as a normal part of starting an engagement:

• Business Associate Agreement (BAA) for healthcare engagements involving protected health information. Our systems are built to support your HIPAA obligations, and we sign a BAA.
• Data Processing Agreement (DPA) for clients with EU or UK data subjects, including the Standard Contractual Clauses or UK Addendum where a transfer requires them.
• Non-Disclosure Agreement (NDA), yours or ours, before confidential information is exchanged.
• Master Services Agreement (MSA) and Statement of Work (SOW) for every engagement, setting out scope, data handling, warranties and ownership.

If your organisation has its own vendor agreements, send them. We review them rather than insisting on our paper.

Where your data lives, and who touches it

Client systems are hosted in the cloud region you choose, typically with a major cloud provider in the United States, and the region is recorded in your Statement of Work. We do not move production data out of that region without your written agreement.

OrganByte is a company registered in Florida, United States. Our engineering and delivery team is based in Karachi, Pakistan, and members of that team may access client systems in order to build, operate and support them. That access is governed by the safeguards above: it is role-based, limited to named people, logged, bound by confidentiality obligations in each person's contract with us, and covered by the DPA or BAA we sign with you. If your policies or regulators require that certain data is never accessed from outside a given country, tell us at scoping and we will design the engagement around it, or tell you honestly if we cannot.

Sub-processors

For each engagement, the DPA or SOW lists every third party that will process your data, what it does and where it runs. We tell you before we add or replace one, and you can object. The providers that run this website itself are listed in our Privacy Policy.

How we build

Defaults that apply to every system we ship:

• Accessibility. Interfaces are designed to WCAG 2.1 AA.
• Payments. We keep clients out of PCI scope wherever possible: card details are entered on the payment provider's hosted pages, never stored or handled by the systems we build.
• AI disclosure. Every AI assistant we deploy tells people it is an AI, in its first message, and tells them what not to send it.
• Consent and retention. Data capture is built with a stated purpose, a consent mechanism where the law requires one, and a retention schedule, rather than collecting everything and deciding later.
• Secure by default. Privacy, applicable compliance requirements and data governance are designed in from the first sprint, never bolted on before launch.

Compliance posture

We describe our posture as status, not as certification, because a misstated credential is the first thing a careful buyer checks.

• We do not currently hold a SOC 2 report or an ISO 27001 certification, and we will not describe ourselves as certified until we do.
• HIPAA compliance is a property of an organisation's practices, not of a product. We do not sell "HIPAA compliant software". We build systems that support your HIPAA obligations, and we sign a BAA.
• Nothing we build is FDA approved or FDA cleared unless we say so in writing for a specific product. Where our work integrates with FDA-cleared diagnostic tools, the clearance belongs to those tools.
• Nothing on this page is a guarantee of your organisation's compliance. Your compliance depends on your policies and practices as well as ours.

Incident response

We maintain a documented incident response process covering detection, containment, investigation, notification and post-incident review. If we become aware of a security incident affecting your data, we notify you without undue delay and within any timeframe your agreement with us specifies, tell you what we know, what we are doing, and what we need from you, and we share a written post-incident report when the investigation closes.

Security questions and questionnaires

Send security questions, vulnerability reports and vendor security questionnaires to info@organbyte.com with the word Security in the subject line, or through our contact page. We answer questionnaires honestly and in full, including the questions where the answer is not yet yes.