Security
Built like hospital infrastructure, because it is
Coda handles operative notes — protected health information. Everything below is how the product is actually built, not a policy aspiration. Full security documentation, including architecture detail, is available under NDA.
What Coda will never do →One hospital, one environment
Every hospital runs in its own fully isolated cloud environment — its own database, its own network, its own keys. There is no shared database, no shared tenancy, and no row-level separation to get wrong: isolation is the architecture, not a filter.
Nothing moves between hospitals. A configuration mistake in one environment cannot expose another hospital’s data, because there is no path between them.
How PHI is handled
Frontier AI, zero retention.
Coda runs on the latest frontier models — the GPT and Claude families — under executed Business Associate Agreements with zero-data-retention terms. Notes are never used to train models and never kept after the run.
Never in operational logs.
Application logs are PHI-redacted by design. Clinical content, identifiers, and credentials never reach operational logging — the clinical record and the system’s plumbing are kept strictly apart.
Encrypted in transit and at rest.
Every connection is encrypted end to end, and databases and storage are encrypted with keys dedicated to each hospital. Key-management detail is in the security documentation available under NDA.
Access and accountability
Strong authentication.
Hospital-grade sign-in with multi-factor authentication, automatic idle-session lockout, and role-based access — a biller, a surgeon, and an administrator each see exactly what their role requires.
Locked to your facility.
As part of each hospital’s rollout, the portal is restricted to that facility’s approved networks — Coda is not a website the open internet can reach.
Operations behind a VPN.
Our own administrative and operational access runs over a private VPN — none of it is publicly accessible.
Every access recorded — including the AI’s.
Every access to a note, human or AI, lands in an append-only audit log: who, what, when, and on whose behalf. The AI is held to the same standard as a person — HIPAA §164.312(b) by design.
Nothing autonomous, nothing silent.
The AI advises; people decide. No note is changed and no claim is prepared without an accountable human action, and every step is attributable after the fact.
How we build
Adversarial review before anything ships.
Every feature is audited by independent reviewers who did not write it — for correctness, security, and compliance — before it can merge. The audit verdict is part of the feature, like its tests.
Built-in vulnerability scanning.
Automated static analysis runs in the delivery pipeline, and built-in scanners continuously sweep the platform for vulnerabilities and drive remediation — issues get found and fixed ahead of any external penetration test.
Staged release, always.
Every change ships to a PHI-free staging environment and is verified there before it can be promoted to any hospital. Production deploys are deliberate, gated actions — never automatic.
Recovery is practiced, not promised.
Point-in-time database recovery with routinely exercised restore drills — backups are proven by restoring them, on a schedule, not assumed to work.
For your security team
We expect your review — and we’re built for it. Full security documentation, including architecture detail and our compliance posture, is available under NDA for hospital security assessments and standard questionnaires.
Found something? Report it to coda@unira.io and we will respond promptly.
Put your security team in the room
Request a demo and bring your reviewers — the security conversation is part of ours, not an afterthought.