Trust Center
Public compliance, security, and privacy documentation for Data Chimp Labs and Kanzi — the Private AI for Healthcare platform.
System Overview
This Trust Center serves as the canonical, public-facing source of truth for Data Chimp Labs corporate compliance and policy frameworks. It provides customers, auditors, and engineering teams with verified documentation on risk mitigation, access controls, and data integrity.
- Security Operations: security@datachimplabs.com
- Privacy & DPO: privacy@datachimplabs.com
- Source Repository: DataChimp Labs’ internal compliance repository is private. Prospects and auditors under NDA may request access.
Public Policies
The following policies are active, version-controlled, and published for audit verification. Each document can be inspected directly or exported to PDF.
Risk management program, internal control frameworks, audit lifecycle, and technical safeguards.
End-user privacy commitments, data processing guarantees, and Plaid Link deployments.
Role-based access controls (RBAC), least-privilege IAM, JML workflows, and access reviews.
Workforce phishing-resistant MFA enforcement and consumer MFA at every gateway.
TLS 1.2+ baseline, HTTP Strict Transport Security (HSTS), certificate lifecycle, and mTLS.
AWS KMS cryptographic key management, envelope encryption, and encrypted storage baselines.
Continuous production scanning, patch SLAs, EOL auditing, pen testing, and disclosure protocols.
Compliance Frameworks
Framework-specific control mappings and narratives are maintained under frameworks/ in the source repository:
| Framework | Status | Scope & Alignment |
|---|---|---|
| SOC 2 Type II | Active Alignment | Trust Services Criteria: Security, Availability, and Confidentiality. |
| HIPAA | Active Alignment | Security Rule & Privacy Rule safeguards for PHI-handling workloads. |
| GDPR / UK GDPR | Active Alignment | Lawful basis, cross-border transfer protections, and Data Subject Rights. |
| ITAR | In Progress | Export-controlled technical data handling and compartmentalization. |
| DoD IL6 | In Progress | Classified impact level specifications up to SECRET for federal workloads. |
Attestations & Vendor Assessments
Formal third-party audit reports, CAIQ/SIG questionnaires, and gated architectural evidence are available under mutual NDA upon request.
Contact: security@datachimplabs.com