Security and compliance
Built for regulated work.
Silogram is designed to support 21 CFR Part 11 and HIPAA requirements for electronic records, electronic signatures and protected health information. Validation in your environment and your SOPs stay with you; Silogram supplies the controls and the evidence.
Every change on the record.
Audit trail
Append-only and tamper-evident. The database records who changed what and when, with old and new values, and refuses changes that don't name who made them.
Electronic signatures
Each signature records the signer, time and meaning, with password re-entry, bound to a SHA-256 digest of the exact content signed.
Approval locks
Approval needs a review by someone else and no open suggestions. It locks the document until someone reopens it with a reason.
Record package
Export a document's signatures, history and audit entries, or the workspace audit trail as CSV or JSON, for an inspection or your archive.
Reproduction, sandboxed
Analysis code is only ever run by a runner in a container with no network, a read-only root and no privileges. Workspaces that allow PHI run it only inside their own network, and a runner pinned to your repository runs only committed code.
Validation package
Each Part 11 and HIPAA requirement has an ID; automated tests carry it, and every release produces a traceability matrix with test evidence.
The right people. The right data.
Two-step sign-in and lockout
Authenticator-app codes, which admins can require. Repeated failed sign-in or signing attempts lock the account.
Automatic sign-out
Idle sessions end after a time the workspace sets, checked in the browser and again on the server.
Roles
Owners, admins, analysts, writers, reviewers and viewers, each with only the permissions the role needs.
PHI guard
Workspaces default to no PHI: likely patient identifiers are blocked from uploads, model calls and agent writes. PHI workspaces allow only BAA-covered model connections and agents.
Read-only to your code
Silogram only reads your analysis code, so a read-only token is enough, and it never changes the code. Keys and tokens are encrypted at rest; connections use TLS.
No training on your documents
Your documents and house style stay in your workspace and are never used to train AI models. You choose the model vendors, with your own keys.
Hosting and assurance, stated plainly.
Supplier qualification comes before a pilot, so here is where things stand today.
- Deployment. Pilots run on a dedicated instance. The security packet names the hosting provider, region and subprocessors.
- PHI. Pilots run in No-PHI workspaces. Silogram turns on PHI for a workspace only after a business associate agreement with Silogram is signed.
- Subprocessors. Model vendors are your choice and use your keys; in PHI workspaces only BAA-covered vendors can be used.
- SOC 2 Type II. Not yet; planned. We share the control descriptions and the validation report under NDA now.
- Shared responsibility. You keep your SOPs, training records, user acceptance testing and your HIPAA program; Silogram supplies the controls, requirement list, test evidence and templates.
- Contact. Security questions and questionnaires: mmargolis27@gmail.com.