Trust & Security
HIPAA-compliant infrastructure built on Microsoft Azure. Every service we use is covered by a signed Business Associate Agreement.
Last updated: September 2026
How every note is handled
- Recording
- Deleted after transcription
- Note content
- Kept until you delete it or your retention period ends
- Trash
- Permanently deleted after 30 days
- Audit trail
- Kept six years, even after the note is deleted
- Model training
- Never
You decide what we keep
HIPAA sets a six-year retention rule for audit records, not for the notes themselves. So the retention period for your notes is yours to set, and deletion does not require contacting us.
What stays
- Your notes, until you delete them or your retention period ends
- The audit trail of who created, edited, copied and deleted each note, for six years
- A note's content history, for as long as the note exists
What's gone
- The audio, once it is transcribed
- Deleted notes, 30 days after they leave your list, or at once if you delete permanently
- Notes older than your retention period, every night
- Anything sent to the AI model: nothing is retained or used for training
Managers choose how long notes are kept, for the whole team, and solo accounts set their own. The default keeps notes until someone deletes them. When a manager removes a worker, they can delete that worker's notes at the same time.
Security checklist
Technical safeguards implemented across infrastructure, application, and mobile layers.
Encryption
- AES-256 encryption at rest for all stored data
- TLS encryption for all data in transit
- HSTS enforced across all endpoints
Network & Infrastructure
- Private VNet with no public database access
- Azure Key Vault for secrets management
- Managed identity with no static credentials on disk
- Private endpoints for all data services
Access Controls
- Role-based access controls (RBAC)
- Optional two-factor sign-in with an authenticator app, plus one-time backup codes
- Rate limiting and brute force protection
- CSRF validation on authentication endpoints; SameSite cookies and origin allowlisting elsewhere
- HTTP-only session cookies (web)
- Certificate pinning (iOS)
Data Protection
- Deleted notes are removed after 30 days, or immediately if you choose
- Set a retention period and notes older than it are deleted automatically
- Audit trail of every action, retained a minimum of 6 years and kept even after a note is deleted
- Content history for every note change, for as long as you keep the note
- 15-minute auto-lock with biometric (mobile)
- 72-hour breach notification policy
How your data flows
Every step is encrypted, isolated, and covered by a Business Associate Agreement.
On your device
You record or type
Input captured on your device. Audio never stored permanently.
Inside TryCaSIE: private Azure network, BAA covered
Transcription
Audio processed by Azure Speech (BAA). Deleted after transcription.
AI structuring
Azure OpenAI formats your note (BAA). No data retained or used for training.
Encrypted storage
Note saved to encrypted PostgreSQL in a private VNet. Visible only to its author.
Back with you
You review and copy
You finalize the note, then copy it into your own system of record.
How the AI is bounded
- Drafts only.
- Every note the AI writes is a draft until a person approves it.
- Copy after review.
- Copying unlocks only after you finalize the note.
- Every change recorded.
- Content history and the six-year audit log show what was entered, suggested and edited.
- No training.
- Azure OpenAI does not retain your data or use it to train models.
Infrastructure certifications
TryCaSIE runs exclusively on Microsoft Azure, which holds the following certifications covering the infrastructure where your data is stored and processed.
- SOC 2 Type IIHeld by Microsoft Azure
- Independent audit verifying security, availability, and confidentiality controls
- ISO 27001Held by Microsoft Azure
- International standard for information security management systems
- HITRUST CSFHeld by Microsoft Azure
- Healthcare-specific security framework combining HIPAA, NIST, and ISO requirements
- FedRAMP HighHeld by Microsoft Azure
- U.S. federal security authorization for cloud services handling sensitive data
Business Associate Agreements
We maintain a Business Associate Agreement with Microsoft Azure that covers all Azure services we use, including Azure OpenAI and Azure Speech Services. It guarantees your data is never used to train AI models and requires HIPAA-compliant handling of all Protected Health Information. We also sign a BAA with you. It is readable in full before you sign, and it sets out the deletion and retention terms above in Section 8.
Agreements
Security questions
hello@trycasie.comFinish case notes in minutes
Speak or type what happened, TryCaSIE turns it into a structured note.
Free for 7 days or 5 notes. No credit card needed.