How sentr. protects PHI, in plain language. Nothing here that we cannot show you.
Every practice, every time.
At rest and in transit.
Kept six years. Nobody can change it.
Enforced by the database itself.
Required on every staff account.
United States only. No PHI in logs.
Runs on
Open any card for the detail. We keep the blueprints to ourselves, but never the facts.
Your Business Associate Agreement is part of signup. No email chain, no waiting.
Every record is encrypted at rest and in transit, and every practice is walled off inside the database itself.
Seven roles, charts scoped to each discipline, and a second step at every sign in.
Who opened, changed, signed, exported or sent what, and when.
sentr. Scribe and sentr. Script run on Anthropic Claude through Amazon Bedrock, inside our own AWS account.
Stripe holds the card. ClaimRev carries the claim. Both connect over encrypted links.
Names, dates of birth and emails are stripped before anything is written to a log line.
Export a family’s full record or a batch of signed notes as PDF, any time, without asking us.
Badges are easy. Here is where we actually stand.
Nobody else touches your data. No analytics trackers, nothing that reports crashes to an outside service, no SMS vendors.
Hosting, storage, identity, email, transcription and the AI models. One BAA covers all of it.
Insurance claims and remittances. Your own subscription, our encrypted connection.
Card payments for family statements. Cards live with Stripe, never with us.
The full list, with what each vendor receives, is on the Subprocessors page and is updated before any change takes effect.
Yes. sentr. is built to the HIPAA Security Rule: encrypted PHI, audited access, a signed BAA, and administrative controls we keep in writing. HIPAA has no official certification, so any vendor who says they are "certified" is describing an audit, not a government stamp.
In AWS data centers in the United States, with encrypted backups kept in a second US region. It never leaves the country.
Nobody by default. Support access happens only through audited emergency access that expires on its own and needs a written reason, and you can see every instance in your own audit log.
They are transcribed inside our AWS account, used to draft your note, and deleted automatically within days. They are never used to train any model.
No. Stripe holds every card. We keep only the last four digits and the card brand so your front desk can recognize it.
Yes. Export a family’s full record or a batch of signed notes as PDF whenever you like. If you leave, we purge your data on request and confirm it in writing.
Tell us before you tell anyone else and we will work with you, not against you. Email hello@thesentr.com with “Security” in the subject.
A founder answers it, not a form.