Q: Clarification on Recordskeeper.ai Security, Compliance, and Data Use
Thank you for your earlier response regarding security. please clarify a few points:
HIPAA Compliance and BAA
Do you sign Business Associate Agreements (BAAs) under HIPAA?
Zero-Knowledge Architecture
Do you use a zero-knowledge encryption model where your admin/engineers do not have access to customer data or documents?
Use of Customer Data in “Training”
When you state that an “AI Agent is created on top of uploaded documents and uses data for training,” can you clarify:
• Is this embedding/indexing for retrieval (documents converted into vectors for private search within my account)?
• Or is this fine-tuning/federated training that alters a shared model and could introduce compliance risks?
Data Isolation
Are customer data and models isolated per account, ensuring no cross-contamination between different customers’ files?
Thank you!
Kanishka_RecordsKeeper
Sep 1, 2025A: Thank you for your detailed inquiry regarding RecordsKeeper.AI's security and compliance capabilities. I appreciate your thorough approach to evaluating our platform. Please find our responses below:
1. HIPAA Business Associate Agreements (BAAs)
We do not currently offer BAAs under HIPAA compliance. However, given the importance of this requirement, I'm escalating this to our compliance team for further evaluation and will provide you with an update.
2. Zero-Knowledge Encryption
Our architecture does not support zero-knowledge encryption models. This is by design, as RecordsKeeper.AI's core functionality - including AI-powered document analysis, intelligent search, and automated retrieval—requires system access to document content to deliver these advanced capabilities effectively.
3. Document Indexing for Private Search
Yes, all document indexing is performed exclusively for private search within your organization's secure environment. Your indexed data remains completely isolated to your account.
4. Data Usage for AI Training
We maintain strict data privacy protocols. Your documents are never used for general LLM training purposes. Our AI learning is restricted to account-level optimization, meaning the system learns from your specific documents solely to enhance search and retrieval accuracy for your team members.
5. Data Isolation and Security
Absolutely. We implement comprehensive account-level isolation for both customer data and AI models, ensuring zero cross-contamination between different organizations' information.
I hope this clarifies our current capabilities. For question #1, I'll follow up shortly with additional information from our compliance team. Please don't hesitate to reach out if you need any clarification on these points.