Compliance

Concentrate’s certifications and agreements

Everything in this table covers Concentrate itself: the company and the platform your requests pass through. It does not cover the model providers Concentrate routes to.

Standard	What Concentrate holds	Where to get it
SOC 2	Concentrate’s own SOC 2 Type I and Type II audits, performed by Sensiba LLP, an independent audit firm	Request the Type II report under NDA in the Trust Center
HIPAA	A Business Associate Agreement (BAA) that Concentrate signs with you, for protected health information (PHI) on a HIPAA-enabled organization	Request a BAA
GDPR, UK GDPR, CCPA/CPRA	Concentrate’s Data Processing Addendum, which also covers the Swiss FADP and US state privacy laws	Data Processing Addendum

Model providers hold their own certifications, and not every provider holds SOC 2. See Provider certifications for how to check a provider and how to keep requests on the providers you approve.

The data controls behind these are available on every account: zero data retention and request logging, and guardrails and redaction.

HIPAA and Business Associate Agreements

You sign one BAA with Concentrate. Concentrate holds the BAAs with the providers that serve covered routes, so you don’t need a separate agreement with each provider. PHI requires both of these:

A signed BAA with Concentrate
An organization with HIPAA mode turned on

Zero data retention on its own does not cover PHI. Any key can turn ZDR on, but only a HIPAA-enabled organization restricts routing to BAA-covered routes.

Request a BAA

HIPAA mode is not self-service. You can’t turn it on from signup or the dashboard.

Request a BAA

Fill out the contact form at concentrate.ai/enterprise and say you need a BAA. Include the models, endpoints, and features your application uses.

Sign the BAA

Concentrate reviews your request and sends the BAA for signature.

Concentrate turns on HIPAA mode

HIPAA mode is turned on for your organization, and you get a confirmation before you send PHI.

Test with synthetic data

Send text that is not real patient information, using a key on the HIPAA-enabled organization.

Go to production

Send PHI only through the HIPAA-enabled organization and its keys.

Plan pricing is on the HIPAA LLM Gateway page.

What HIPAA mode enforces

These settings apply to the organization and every key under it. Nobody in the organization can turn them off.

Setting	On a HIPAA-enabled organization
Zero data retention	Locked on. A route must support ZDR to be used
Request logging	Locked off. Prompt and response bodies are not stored
Provider routes	BAA-covered routes only, including fallbacks
Auto routing	`"model": "auto"` picks only among BAA-covered routes
BYOK	Unavailable. The BAAs don’t cover your own provider accounts

Concentrate still records the metadata listed under What Is Always Logged, such as model, provider, token usage, and cost. Audit logs record settings and access changes, not prompt content. If no BAA-covered route can serve a request, the API returns a 422 with the message HIPAA mode is enabled, but there are no available providers with a Business Associate Agreement for this request. It never falls back to a route without a BAA. HIPAA mode checks for a BAA and zero data retention. It does not check a provider’s other certifications, such as SOC 2. If you need both, check the providers on your BAA-eligible routes under Provider certifications and limit routing to the ones you approve.

Features with their own coverage

Feature	On a HIPAA-enabled organization
Prompt caching	Supported
Web search	Coverage depends on which engine runs the search. Confirm your search setup with Concentrate before sending PHI
Anthropic server tools on the Messages API	The Files API, Skills API, code execution, computer use, web fetch, advisor, and external MCP servers are outside Anthropic’s BAA. Requests that use them return a `422`

HIPAA does not certify AI gateways. The BAAs set the terms, and the locked settings keep traffic on covered routes. You remain responsible for your own HIPAA obligations.

Find BAA-eligible models

BAA coverage belongs to a (model, provider) pair, not to a model or its author alone. Every provider entry in the Models API has a baa boolean. A route with "baa": true also supports zero data retention. “BAA-eligible” means the route can serve PHI once you have a signed BAA and a HIPAA-enabled organization. It does not turn any protection on by itself. Check one model:

curl -s https://api.concentrate.ai/v1/models/claude-sonnet-5-5 \
  | jq '.providers | map_values({baa})'

{
  "anthropic": { "baa": true },
  "azure": { "baa": true },
  "vertex": { "baa": false }
}

List every model with at least one BAA-covered route:

curl -s https://api.concentrate.ai/v1/models \
  | jq -r '.data[] | select(any(.providers[]; .baa == true)) | .slug'

You can also browse them without the API:

Model Fortress with the BAA-eligible filter on
The covered models table, with the rate for each route

On a HIPAA-enabled organization you don’t need to pin providers. Routing already skips every route where baa is false.

Provider certifications

Concentrate’s SOC 2 report covers Concentrate. It does not extend to the model provider that serves a request. Each provider holds its own certifications, and not every provider holds SOC 2.

Check a provider

Every provider entry in the Models API has a certifications array. It lists the certifications Concentrate has on record for that provider. An empty array means none are on record.

Value	Certification
`soc2_type1`	SOC 2 Type I
`soc2_type2`	SOC 2 Type II
`iso27001`	ISO/IEC 27001
`iso27701`	ISO/IEC 27701
`iso42001`	ISO/IEC 42001
`fedramp`	FedRAMP

List every provider with its certifications:

curl -s https://api.concentrate.ai/v1/models | jq -r '
  [.data[].providers[]] | unique_by(.provider_slug)[]
  | "\(.provider_slug): \(.certifications | join(", "))"'

To browse without the API, filter Model Fortress by certification.

Keep requests on providers you approve

No setting filters routing by certification. To keep requests on the providers you approve, name them:

For an organization, team, or key: set a model access policy. It is an allowlist of models and providers. Fallbacks stay inside the list, and a request with no permitted route is rejected.
For a single request: pass routing.provider.whitelist. See Routing.

{ "routing": { "provider": { "whitelist": ["openai", "azure"] } } }

Providers as sub-processors

Model providers are sub-processors under the Data Processing Addendum. The DPA covers them as a group, names several, and makes the current list available on request. List Providers returns every provider Concentrate can route to.

Reports and agreements

Trust Center

Security program overview and SOC 2 Type II report requests under NDA

Data Processing Addendum

Data processing terms for GDPR, UK GDPR, CCPA/CPRA, and other privacy laws

Privacy Policy

How Concentrate handles personal data, and its security measures

Terms of Service

The terms that govern your use of Concentrate

For anything this page doesn’t answer, email support@concentrate.ai.

Zero Data Retention & Logging

ZDR, request logging, and organization-level enforcement

Guardrails & Redaction

Redact PII, PCI, and PHI from requests and responses

Get Model

Per-provider baa, zdr, and certifications for one model

Routing

How routing selects providers

Get started

Features

Monitoring

Changelog

Compliance

Concentrate’s certifications and agreements

HIPAA and Business Associate Agreements

Request a BAA

What HIPAA mode enforces

Features with their own coverage

Find BAA-eligible models

Provider certifications

Check a provider

Keep requests on providers you approve

Providers as sub-processors

Reports and agreements

Trust Center

Data Processing Addendum

Privacy Policy

Terms of Service

Zero Data Retention & Logging

Guardrails & Redaction

Get Model

Routing

​Concentrate’s certifications and agreements

​HIPAA and Business Associate Agreements

​Request a BAA

​What HIPAA mode enforces

​Features with their own coverage

​Find BAA-eligible models

​Provider certifications

​Check a provider

​Keep requests on providers you approve

​Providers as sub-processors

​Reports and agreements

Trust Center

Data Processing Addendum

Privacy Policy

Terms of Service

​Related Documentation

Zero Data Retention & Logging

Guardrails & Redaction

Get Model

Routing

Concentrate’s certifications and agreements

HIPAA and Business Associate Agreements

Request a BAA

What HIPAA mode enforces

Features with their own coverage

Find BAA-eligible models

Provider certifications

Check a provider

Keep requests on providers you approve

Providers as sub-processors

Reports and agreements

Related Documentation