Data protection
Encrypted everywhere
Encrypted storage at rest, TLS in transit. Cases are scoped to the officer who created them — another officer sees a case only if it is deliberately shared or transferred, and every one of those actions is recorded.
Business Associate Agreements
We sign a BAA with every customer and operate to HIPAA's Security Rule. AI processing runs only under HIPAA-eligible agreements.
Never used to train AI
Veteran records are never sold, shared, or used to train models. This is a contract term, not a policy page.
Retention you control
Officers delete any case themselves in one action once the veteran has their copy. Everything remaining is deleted or returned at the end of an engagement, and our agreement commits us to notifying you of any suspected unauthorized access within 72 hours.
Tampering and integrity — for the "what could go wrong" questions
- Nothing is installed in your office. Guidon is delivered as a secure web service — there is no local software on county machines to tamper with, copy, or steal. Your office holds logins, not code.
- Tamper-evident audit trail. Every upload, view, analysis, and export is written to an append-only log that no one — including us — can silently edit. Retained six years; reviewable by your auditor.
- Access control. A unique login per officer, with passwords stored only as bcrypt hashes — after an officer sets their own, no one at Guidon can read it. Repeated failed sign-ins lock the account automatically. Password reset is self-service, by a single-use link that expires in 30 minutes. Sessions end after 30 minutes of inactivity, so an unattended screen signs itself out. Each officer sees only their own cases unless they explicitly share or transfer one to a colleague.
- What we do not have yet — stated plainly. There is no multi-factor authentication in the product today; access is password-based. MFA is on the roadmap, and we would rather tell you that than let you discover it during a review. If MFA is a requirement for your office, say so and we will treat it as a condition of doing business with you rather than a wish-list item.
- Versioned deployments. Every change to the analysis engine is committed to version control with an author and a timestamp, deployed from that record, and reversible. We can tell you exactly what code produced a given report, and when it changed.
- The human stays in command. Structurally, not just by policy: no auto-submit pathway exists in the product, so no compromise of the tool could file anything with the VA.
Pilot posture, stated plainly: pilots run on redacted or synthetic
cases until the production security environment is stood up for your office — we will not handle a real
veteran's records outside the protections described here. If a vendor will, ask them why.
Questions an IT reviewer should ask any AI vendor (including us)
- Where is the data processed, and under what agreements? (Ours: HIPAA-eligible cloud infrastructure under signed BAAs.)
- Is customer data used to train models? (Ours: never — contractually.)
- Can the vendor's own staff alter audit records? (Ours: no — append-only by design.)
- What happens when the AI isn't sure? (Ours: it says so, names the missing fact, and a human decides. See our accuracy page.)