HITRUST e1
2026 assessment completed; final reports available.
Review HITRUST e1 assessmentSECURITY & COMPLIANCE
Security for
critical operations.
Protect sensitive data. Control access. Govern every agent.
Independently assessed security, isolated environments, and cloud and on-premises deployment options for healthcare enterprises.
SOC 2 Type II
Security, Availability, and Confidentiality.
Request SOC 2 report
HIPAA
Security and Breach Notification Rules.
Request HIPAA assessment
PIPEDA & PHIPA
Canadian federal and Ontario health privacy.
Request Canada brief
GDPR
European privacy controls and DPA.
Review our DPAOPERATIONAL SAFEGUARDS
Control over data.
Oversight of every agent.
Define who can access data, what agents can do, and how activity is reviewed. Concurrence brings these controls into the infrastructure and workflows behind patient care.
Identity & Permissions
Granular roles and scoped permissions control access. SSO, enforced MFA, and device-bound access protect our operations.
Isolated Environments
Tenant isolation, regional data boundaries, and dedicated single-tenant deployments. Encryption protects data at rest and in transit.
Auditability & Monitoring
Traceable user and agent activity, contextual audit logs, and continuous monitoring support oversight and investigation.
Agent Governance
Simulation validation, scoped tool permissions, and human escalation keep clinical agents within approved workflows.
Customer Data Protection
Our standard DPA prohibits AI training with customer data and defines retention, deletion, and subprocessor obligations.
Operational Resilience
Independent testing, tracked remediation, backup and recovery procedures, and incident response with defined customer notification obligations.
INDEPENDENT ASSESSMENTS
Evidence for your security review.
The final report defines the assessed system, boundaries, and applicable dates. Ask our security team to map that scope to your proposed deployment, including hosting, model providers, integrations, and processing locations. Platform support for a cloud or data service does not establish its inclusion in the assessment.
HITRUST e1 assessment completed
Concurrence has completed its 2026 HITRUST e1 assessment. Final reports are available for security review through our Trust Center. The assessment is recorded as Amigo AI 2026 e1 under Amigo, Inc., the legal entity behind Concurrence.
Review HITRUST e1 assessmentSOC 2 Type II audited
The Concurrence Platform audit covers November 1, 2024–October 31, 2025. Thoropass Assurance issued the report on February 18, 2026 with an unmodified opinion.
Request SOC 2 reportHIPAA attested
Our completed Thoropass assessment received a satisfactory result as of June 13, 2025. A BAA is available; Privacy Rule obligations flow through the BAA. PHI processing requires the applicable agreement and security configuration.
Request HIPAA assessmentIndependently tested
Thoropass tested our web application and API in May–June 2026. The final report, dated June 8, records independently validated remediation of that engagement’s findings.
Request executive summaryDEPLOYMENT OPTIONS
Your infrastructure.
Your deployment.
Deploy in the cloud or on-premises, with dedicated single-tenant options. Live in 10 countries, with broader deployment support across all regions covered by AWS, Microsoft Azure, Google Cloud (GCP), Databricks, and Snowflake and regional infrastructure partners.
Explore live and supported coverageWhere data is stored
Data, logs, and backups reside in the hosting locations defined for your deployment.
Where AI processes data
Model inference has separate processing locations. Regional hosting does not guarantee regional inference, and some models are unavailable in a required region.
Cloud
Supported by Concurrence
Amazon Bedrock
Regional or cross-region, depending on the model and inference profile.
Cloud
Supported by Concurrence
Azure OpenAI / Foundry
Regional, Data Zone, or Global. Model availability varies.
Cloud
Supported by Concurrence
Vertex AI
Regional processing depends on the model, endpoint, and feature.
Data platform
Supported by Concurrence
Foundation Model APIs / Unity Gateway
Workspace, model endpoint, and fallback locations can differ.
Data platform
Supported by Concurrence
Snowflake Cortex AI
Inference can use other regions or clouds when cross-region processing is enabled.
| Cloud or data platform | Concurrence support | AI processing considerations |
|---|---|---|
 Cloud | Supported | Amazon Bedrock Regional or cross-region, depending on the model and inference profile. |
 Cloud | Supported | Azure OpenAI / Foundry Regional, Data Zone, or Global. Model availability varies. |
 Cloud | Supported | Vertex AI Regional processing depends on the model, endpoint, and feature. |
 Data platform | Supported | Foundation Model APIs / Unity Gateway Workspace, model endpoint, and fallback locations can differ. |
 Data platform | Supported | Snowflake Cortex AI Inference can use other regions or clouds when cross-region processing is enabled. |
We confirm storage, inference, and fallback locations for the selected models and cloud or on-premises deployment at contracting.
WORK DIRECTLY WITH CONCURRENCE
Government and critical use cases.
Contact our team to discuss your mission, deployment architecture, and security requirements.
SECURITY RESOURCES
Review the evidence.
In the Trust Center
Request our DPA, Data Protection Policy, audit reports, our penetration-test summary, and our regional compliance briefs.
Open Trust CenterSubprocessors for your deployment
Request the current list of providers that process customer data and their processing locations for your enabled services.
Request subprocessor listDUE DILIGENCE
Security FAQs
What is Concurrence’s HITRUST e1 status?
Concurrence has completed its 2026 HITRUST e1 assessment. Final reports are available for security review through our Trust Center. The assessment is recorded as Amigo AI 2026 e1 under Amigo, Inc., the legal entity behind Concurrence.
Does the HITRUST e1 assessment cover every deployment?
The final report defines the assessed system, boundaries, and applicable dates. Ask our security team to map that scope to your proposed deployment, including hosting, model providers, integrations, and processing locations. Platform support for a cloud or data service does not establish its inclusion in the assessment.
Is a HIPAA assessment the same as a certification?
No. HIPAA does not have an HHS-recognized certification program. Concurrence has an independent assessment of the Security and Breach Notification Rules. Using PHI still requires an executed BAA, the required safeguards, and review of your organization’s obligations.
Is Concurrence SOC 2 Type II audited?
Yes. The report covers the Concurrence Platform across the Security, Availability, and Confidentiality criteria. Request the current issued report through the Trust Center.
What privacy commitments does Concurrence make?
We maintain privacy controls and contractual protections for personal and health data, covering data-subject rights, international transfers, retention, and deletion. Our Data Processing Addendum and the regional compliance briefs for your jurisdiction are available through the Trust Center; your executed agreement defines the applicable obligations.
Can we use Concurrence with protected health information?
Yes, with an executed Business Associate Agreement and the required security configuration. Your BAA defines which Privacy Rule obligations apply.
Can all models process data in our chosen region?
No. Hosting and inference locations are separate. Model availability, provider routing, and fallback settings determine where AI processes data, and some models are unavailable in a required region.