Trust
What we can prove
Most trust pages open with a row of certification logos. Ours opens by telling you we hold none, because a badge that belongs to the company renting us a datacentre is not evidence about us. What we have instead is documents — the transfer clauses with their annexes filled in, the assessment behind them, three sub-processors with their locations, and an honest list of what is still missing.
Last updated 25 August 2026
01Certifications we hold
None.
Clinic+ is not certified under SOC 2, ISO/IEC 27001, HIPAA or any equivalent scheme, and no audit is in progress. If your procurement process requires a certificate number, we do not have one to give you today.
We would rather you read that in the first line than find it in a footnote. Certification is a real signal and we intend to pursue ISO/IEC 27001 — the standard European healthcare buyers actually ask for — when a customer needs it or the team is large enough for the controls to describe something real rather than a process between one person and themselves. Neither is true yet.
What follows is what we can show instead: the infrastructure's own certifications, clearly marked as not ours, and then the documents. The documents are the part we think is worth your time.
02Certifications the infrastructure holds — Google’s, not ours
Every clinical record lives in Google Cloud, and Google's compliance programme covers the platform underneath us. These are Google's certificates. They say the datacentre, the hardware and the managed services are audited. They say nothing about our application, our access controls or our staff, and running on certified infrastructure earns a tenant no certification of its own.
| Held by | Programmes we rely on |
|---|---|
| Google Cloud | ISO/IEC 27001, 27017 and 27018; SOC 1, 2 and 3; PCI DSS; and HDS v2.0, the French health-data hosting certification. |
| Clinic+ | None — see section 1. |
We link rather than reproduce, because a certificate's scope changes and our summary of it would not: Google Cloud compliance offerings. Check the scope against the region and services in section 4 rather than taking our word for the mapping.
03The documents, and none of them behind a form
Everything below is published. There is no request form, no work email to hand over and no NDA — a security posture that can only be examined by people who first identify themselves as buyers is not being examined.
| Document | What it answers |
|---|---|
| Data Processing Agreement | The art. 28 contract: what we may do with clinic data, on whose instructions, and what happens at the end. |
| Standard Contractual Clauses | The transfer instrument, with Annexes I, II and III completed — not "SCCs are available on request". |
| Transfer impact assessment | Clause 14: whether US law prevents us honouring those clauses. Summarised publicly; the full document on request. |
| Security | How isolation, permissions, logging and media access actually work, and what we deliberately do not do. |
| Availability | Every country a clinic may sign up from, and the legal basis for each. |
| Privacy | Where we are a controller, where we are a processor, and the difference. |
Data Processing AgreementStandard Contractual ClausesSecurityAvailabilityPrivacyTerms
04Sub-processors — all three of them
Three, and the number is the point. Every additional party is another place clinical data can sit, another contract to keep current and another row on the diligence questionnaire you are filling in.
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud / Firebase | Database, file storage, authentication, application hosting. Duration: the life of the account. | europe-west1 — St. Ghislain, Belgium |
| Resend | Transactional email: confirmations, reminders, magic links. Duration: the time needed to deliver each message. | us-east-1 — United States — Standard Contractual Clauses |
| Anthropic | Generation of assistant replies and handoff summaries, for the chat widget and the in-panel assistant. Duration: the length of each request. | Outside the EEA — Standard Contractual Clauses |
These rows are the same array that renders Annex III of the Clauses, so this page cannot list a sub-processor the contract does not, or omit one it does. Under Clause 9 you get 30 days' notice before the list changes, and you may object.
No analytics provider, no advertising network, no data warehouse, no session-replay tool. Those absences are choices, and they are the reason this table is short.
05Where the data is, and where we will sell
Clinical records are stored in Google Cloud europe-west1, in St. Ghislain, Belgium. Not "in the EU by default", not "region selectable" — there is one region and every clinic is in it.
We also publish where a clinic may sign up from, which almost nobody does. Today that is 3 countries, each with the instrument or the rule that puts it on the list, and the onboarding gate reads the same list this page counts. See availability.
The reason to publish it is that the alternative is letting somebody discover it at the end of a signup form, and the reason it is short is that we decline markets where the paperwork does not exist yet rather than sell into them and hope.
06What we do not have yet
The section that makes the rest of this page worth reading. It is maintained honestly, and it shrinks.
| Not in place | Where that leaves you |
|---|---|
| Two-factor authentication | Sign-in is email and password. This is the largest gap on this page and it is being built. Until it ships, an account is as strong as its password — enforce good ones, and remove leavers promptly. |
| Independent penetration test | None commissioned. Isolation between clinics is covered by an automated test that boots the database emulator and tries to cross the boundary, which is evidence but is not an outside opinion. |
| SOC 2 / ISO 27001 | Not held, not in progress. See section 1. |
| A settled answer on French HDS | Records sit in the EEA and Google Cloud holds HDS v2.0. Whether a SaaS provider on certified infrastructure needs its own certification is not settled, and we are working through it. If you are a French clinic, raise it with us before you enter patient data. |
| HIPAA / a BAA | Not offered, and the United States is not a market we sell into. Section 5. |
| Automatic breach detection | Unusual export volume raises a banner in the panel; nobody is paged. A clinic reading its own audit log is currently the fastest detection we have. |
07Security questionnaires
Send it. We answer questionnaires rather than refusing them on the grounds that a certification report would have answered for us — we do not have one, so the questions get answered individually, by somebody who knows the system.
Two things make that faster. Point us at the sections above for anything already published, so the answers you get are the ones another clinic can also read. And tell us your deadline, because a questionnaire without one waits behind a questionnaire with one.
Write to hello@clinicplus.io.
08Reporting a vulnerability
Write to hello@clinicplus.io with enough detail to reproduce it. You will get a human reply, not a ticket number.
There is no bug bounty, so we are not going to pretend one is coming. What we will do is fix it, tell you when it is fixed, and credit you if you want to be credited.