Private to each user
Report content is private to the user who creates it. Office administrators and Forensia staff have no automatic access to that content.
Security and privacy
Built to HIPAA standards
As forensic professionals, we understand the responsibility that comes with sensitive case information. That is why ForensicReport is designed around HIPAA privacy and security requirements, with safeguards for how your information is accessed, processed and stored.
Encrypted storage, encrypted in both directions
The security design uses encrypted connections and managed cloud storage with encryption at rest, protecting report data as it moves and while it is stored.
Access is controlled and recorded
Role-based access and an append-only activity log are part of the security design. The log is designed to record access, changes, and exports without allowing the application to rewrite it.
A controlled enterprise AI endpoint
AI processing is designed to use approved enterprise endpoints under a Business Associate Agreement, with controlled access. Consumer AI chat services are excluded from patient-data workflows.
You control the export
Export is an action you take, when you decide the working draft is ready. Reports are finalized and released in the system your office already uses.
Security built around HIPAA requirements
Individual access controls, encryption, audit logging and documented data-handling procedures are designed to support HIPAA safeguards. Vendor agreements and operational procedures are part of the same security requirements.
Safeguards for sensitive information
Our security design combines approved AI endpoints, controlled access, encryption and applicable Business Associate Agreements. Details about infrastructure and service providers are available on request.
- A Business Associate Agreement with your office, signed before any patient data is processed
- A BAA with every provider that touches that data, the AI provider included, required before the provider handles patient data
- Encryption in transit and at rest, in both directions
- Individual report ownership, with access controls enforced for each user
- An append-only audit log the application cannot rewrite or delete
- Minimum necessary handling, with data-use restrictions set out in the vendor agreements
- Breach notification on a defined timeline
- Workforce training and access review, with a named security contact
Need details for a security or procurement review? Request information about our infrastructure, data handling and agreement coverage
Data processing and sub-processors
The data processing addendum and sub-processor documentation form one security review package, available on request to security and privacy officers.
These documents are shared directly for your review. They are not published on this website.
- How the system is built, in the terms a security review asks for
- Business Associate Agreement status
- Data processing terms and sub-processor details
- Answers to the questionnaire your office already uses
- Status of external testing, screening, and audits
Request the set
Tell us who is reviewing it and we will explain which materials are ready for your office.
Request documentationCompliance documentation is being finalized with counsel. We will explain what is available today and what has yet to be completed.
Send us your security questionnaire
Offices that buy software like this usually have one. We would rather answer it early than late.
Contact us