Trust Center | Anchor

Compliance status

In progress

SOC 2

Examination by an independent CPA firm. Type 2 covering Security, Availability, and Confidentiality for the period November 16, 2026 through February 15, 2027. Type 1 covering Processing Integrity and Privacy as of November 16, 2026.

In place

HIPAA

Anchor operates as a business associate, signs Business Associate Agreements with health plans, and maintains written privacy, security, and breach notification policies.

Planned

HITRUST

Anchor plans to pursue HITRUST certification after completing its first SOC 2 examination.

Processing Integrity and Privacy join the Type 2 examination period that follows production launch. Anchor shares its SOC 2 report under a nondisclosure agreement once issued.

Governance

A designated HIPAA Privacy Official (Anchor's Compliance Officer) and HIPAA Security Official (Anchor's Chief Technology Officer).
Board-approved compliance policies, reviewed at least annually.
Anonymous compliance reporting channels open to employees, contractors, and vendor staff, with a separate channel to an advisor outside management for concerns about the Chief Executive Officer.

Security practices

Production systems hosted on Amazon Web Services. Anchor reviews AWS attestation reports and performs a risk analysis of AWS at least annually.
Encryption of customer data in transit and at rest.
Multi-factor authentication required on company accounts.
Role-based access, granted on a minimum necessary basis.
Written incident response and breach notification procedures, with notice to health plans as each Business Associate Agreement requires.

Workforce

Background checks before an employee's start date.
Screening of every employee, contractor, and development partner against the HHS OIG List of Excluded Individuals and Entities and SAM.gov before engagement and monthly thereafter.
HIPAA training before access to any system that may contain protected health information, and annually after that.
Code of Conduct acknowledgment within 90 days of hire and annually after that.

Vendors

Anchor signs Business Associate Agreements with subcontractors that handle protected health information and reviews the security of vendors that support its platform.

Requests

Health plans may request Anchor's security documentation, completed security questionnaires, and, once issued, its SOC 2 report at security@anchorcare.ai. Documents are shared under a nondisclosure agreement.

Reporting a security issue

To report a suspected vulnerability or security incident, email security@anchorcare.ai. To report a compliance concern, including anonymously, use the compliance reporting page.