Asternoos handles some of the most sensitive data there is: recordings of medical consultations. This page describes the controls we have in place today, and — just as importantly — what we do not yet offer, so you can make an informed decision before using it in your practice. For a visual walkthrough, see How we protect data.
We publish this honestly rather than claiming blanket "compliance". If a control you need is in the not yet available section below, talk to us at security@asternoos.com before rolling out Asternoos.
1. Where your data lives
- Application servers and databases run on Amazon Web Services in the European Union (Frankfurt).
- Audio files are stored in AWS object storage in the same region.
- AI processing is performed by OpenAI and Google under API terms that exclude customer data from model training. These providers may process data outside the EU; see Privacy Policy §6.
- A complete provider list is on the Subprocessors page.
2. How data moves through the system
- The clinician records or uploads audio in the app.
- Audio is transmitted over TLS and stored encrypted in AWS object storage.
- Audio is sent to the speech-to-text provider and a transcript is returned.
- The transcript is sent to the language model provider, which returns a structured draft note.
- The note and patient record are written to our encrypted database. The clinician reviews and edits before the note is used.
- Raw audio is deleted automatically after its retention window unless the clinician explicitly chooses to keep it.
3. Encryption
- In transit: TLS 1.2 or higher for all connections between the app, our API, and every provider. HTTPS is enforced; plain HTTP requests are redirected.
- At rest: audio and uploaded files are encrypted at rest in AWS object storage using AWS-managed keys.
- Credentials: passwords are stored only as bcrypt hashes with per-password salts. We cannot recover or read your password.
- Secrets: API keys and database credentials are held in server-side environment configuration, never in client code or the repository.
4. Access control
- Authentication uses signed, expiring session tokens. Sessions can be invalidated.
- Every query for clinical data is scoped to the authenticated account, so one clinician cannot read another's patients, notes, or recordings.
- Production access is limited to the small number of engineers who need it, under least privilege.
- Staff do not access patient content in the normal course of operating the service. Access happens only for a specific support request or incident investigation.
- Production data is never copied into development or test environments.
5. Retention and deletion
- Raw audio defaults to a 7-day retention window and is then deleted automatically. Clinicians can explicitly mark a recording to keep. Clinics that need a shorter window (for example 24–72 hours) can request one.
- Transcripts, notes, and patient records persist as your clinical record until you delete them or close your account.
- Deletion requests are actioned within 30 days and propagate to encrypted backups as those backups age out (up to 35 days).
- Full retention detail is in Privacy Policy §7.
6. AI providers do not train on your data
We use OpenAI and Google Gemini through their business API tiers, under terms where customer content submitted via the API is not used to train their models. Asternoos does not train models on customer audio, transcripts, or notes either, and this is technically disabled rather than merely promised. Should that ever change, we would require a separate lawful basis and give advance notice.
7. Logging and monitoring
- Application and access logs are retained for up to 12 months for security investigation.
- We exclude clinical content — audio, transcripts, note bodies — from application logs and third-party analytics.
- Rate limiting protects authentication and processing endpoints from abuse.
8. Regulatory posture — the honest version
KVKK (Türkiye)
The physician, clinic, or hospital is the data controller; Asternoos is a data processor. We provide a Data Processing Agreement on request, publish our subprocessor list, support data-subject access, correction, export, and deletion requests, and provide a patient-facing Patient Information Notice you can use to inform patients before recording. Consultation recording and AI processing require the patient's explicit consent, which the clinician must obtain.
GDPR (EU/EEA)
Infrastructure is hosted in the EU. We support data subject rights, maintain records of processing, and rely on Standard Contractual Clauses plus encryption for transfers outside the EEA.
HIPAA (United States)
Asternoos is built with technical safeguards that align with the HIPAA Security Rule — encryption in transit and at rest, access control, audit logging, and tenant isolation. However, we do not currently sign Business Associate Agreements and Asternoos is not HIPAA-certified. Asternoos is designed for use in Türkiye and the EU. Do not use it to process US protected health information until a BAA is in place.
Medical device regulation
Asternoos is not a medical device and holds no CE mark under the EU MDR, no Turkish medical device registration, and no FDA clearance. See our AI Disclaimer.
9. What we do not yet offer
| Control | Status |
|---|---|
| SOC 2 Type II report | Not available |
| ISO 27001 / ISO 27799 certification | Not available |
| HIPAA Business Associate Agreement | Not available |
| Published independent penetration test | Not yet performed |
| Two-factor authentication for clinician accounts | On the roadmap |
| SSO / SAML for institutions | Not available |
| Customer-managed encryption keys | Not available |
| Data residency inside Türkiye | EU only today; contact us |
| On-premise or private-cloud deployment | Not available |
| Automated de-identification before sending text to AI providers | In development |
| Contractual uptime SLA on self-service plans | Not offered |
| Data Processing Agreement | Available on request |
| Data export and full account deletion | Available |
10. Incident response
We maintain an incident process covering detection, containment, session and token revocation, evidence preservation, scope analysis, and remediation. If a personal data breach affects your data, we notify the affected controller without undue delay and normally within 24 hours of confirming it, with what we know about scope, cause, and next steps, so you can meet your own 72-hour notification deadline to the Turkish Data Protection Authority or your supervisory authority.
11. Reporting a vulnerability
Email security@asternoos.com with steps to reproduce and any supporting detail. Please give us a reasonable period to investigate and fix before public disclosure. Do not access, modify, or exfiltrate other users' data while testing, and do not run automated scanning that could degrade the service for clinicians. We will acknowledge reports within 3 business days and will not pursue legal action against good-faith research that follows these guidelines.
12. Questions from clinics and hospitals
We answer security questionnaires and provide a Data Processing Agreement, subprocessor list, and architecture and data-flow documentation. Contact security@asternoos.com or legal@asternoos.com.