> ## Documentation Index
> Fetch the complete documentation index at: https://concentrate.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> Concentrate's own certifications and agreements: SOC 2 Type II, HIPAA workloads under a Business Associate Agreement (BAA), and a Data Processing Addendum for GDPR and CCPA. Covers how to request a BAA, how to find BAA-eligible models, and how to check the certifications each model provider holds.

## Concentrate's certifications and agreements

Everything in this table covers Concentrate itself: the company and the platform your requests pass through. It does not cover the model providers Concentrate routes to.

| Standard | What Concentrate holds | Where to get it |
| - | - | - |
| **SOC 2** | Concentrate's own SOC 2 Type I and Type II audits, performed by Sensiba LLP, an independent audit firm | Request the Type II report under NDA in the [Trust Center](https://trust.concentrate.ai/) |
| **HIPAA** | A Business Associate Agreement (BAA) that Concentrate signs with you, for protected health information (PHI) on a HIPAA-enabled organization | [Request a BAA](#request-a-baa) |
| **GDPR, UK GDPR, CCPA/CPRA** | Concentrate's Data Processing Addendum, which also covers the Swiss FADP and US state privacy laws | [Data Processing Addendum](https://concentrate.ai/legal/data-processing-addendum) |

> [!NOTE]
>
> Model providers hold their own certifications, and not every provider holds SOC 2. See [Provider certifications](#provider-certifications) for how to check a provider and how to keep requests on the providers you approve.

The data controls behind these are available on every account: [zero data retention and request logging](https://concentrate.ai/docs/api-reference/endpoint/zero-data-retention.md), and [guardrails and redaction](https://concentrate.ai/docs/api-reference/endpoint/guardrails-redaction.md).

## HIPAA and Business Associate Agreements

You sign one BAA with Concentrate. Concentrate holds the BAAs with the providers that serve covered routes, so you don't need a separate agreement with each provider.

PHI requires both of these:

* A signed BAA with Concentrate
* An organization with HIPAA mode turned on

> [!WARNING]
>
> Zero data retention on its own does not cover PHI. Any key can turn ZDR on, but only a HIPAA-enabled organization restricts routing to BAA-covered routes.

### Request a BAA

HIPAA mode is not self-service. You can't turn it on from signup or the dashboard.

**1. Request a BAA**

Fill out the contact form at [concentrate.ai/enterprise](https://concentrate.ai/enterprise) and say you need a BAA. Include the models, endpoints, and features your application uses.

**2. Sign the BAA**

Concentrate reviews your request and sends the BAA for signature.

**3. Concentrate turns on HIPAA mode**

HIPAA mode is turned on for your organization, and you get a confirmation before you send PHI.

**4. Test with synthetic data**

Send text that is not real patient information, using a key on the HIPAA-enabled organization.

**5. Go to production**

Send PHI only through the HIPAA-enabled organization and its keys.

Plan pricing is on the [HIPAA LLM Gateway](https://concentrate.ai/hipaa-llm-gateway) page.

### What HIPAA mode enforces

These settings apply to the organization and every key under it. Nobody in the organization can turn them off.

| Setting | On a HIPAA-enabled organization |
| - | - |
| Zero data retention | Locked on. A route must support ZDR to be used |
| Request logging | Locked off. Prompt and response bodies are not stored |
| Provider routes | BAA-covered routes only, including fallbacks |
| Auto routing | `"model": "auto"` picks only among BAA-covered routes |
| [BYOK](https://concentrate.ai/docs/api-reference/endpoint/byok.md) | Unavailable. The BAAs don't cover your own provider accounts |

Concentrate still records the metadata listed under [What Is Always Logged](https://concentrate.ai/docs/api-reference/endpoint/zero-data-retention.md#what-is-always-logged), such as model, provider, token usage, and cost. Audit logs record settings and access changes, not prompt content.

If no BAA-covered route can serve a request, the API returns a `422` with the message `HIPAA mode is enabled, but there are no available providers with a Business Associate Agreement for this request.` It never falls back to a route without a BAA.

HIPAA mode checks for a BAA and zero data retention. It does not check a provider's other certifications, such as SOC 2. If you need both, check the providers on your BAA-eligible routes under [Provider certifications](#provider-certifications) and limit routing to the ones you approve.

### Features with their own coverage

| Feature | On a HIPAA-enabled organization |
| - | - |
| [Prompt caching](https://concentrate.ai/docs/api-reference/endpoint/prompt-caching.md) | Supported |
| [Web search](https://concentrate.ai/docs/api-reference/endpoint/web-search.md) | Coverage depends on which engine runs the search. Confirm your search setup with Concentrate before sending PHI |
| Anthropic server tools on the [Messages API](https://concentrate.ai/docs/api-reference/endpoint/create-message.md) | The Files API, Skills API, code execution, computer use, web fetch, advisor, and external MCP servers are outside Anthropic's BAA. Requests that use them return a `422` |

> [!NOTE]
>
> HIPAA does not certify AI gateways. The BAAs set the terms, and the locked settings keep traffic on covered routes. You remain responsible for your own HIPAA obligations.

## Find BAA-eligible models

BAA coverage belongs to a **(model, provider) pair**, not to a model or its author alone. Every provider entry in the Models API has a `baa` boolean. A route with `"baa": true` also supports zero data retention.

"BAA-eligible" means the route can serve PHI once you have a signed BAA and a HIPAA-enabled organization. It does not turn any protection on by itself.

Check one model:

```bash theme={null}
curl -s https://api.concentrate.ai/v1/models/claude-sonnet-5-5 \
  | jq '.providers | map_values({baa})'
```

```json theme={null}
{
  "anthropic": { "baa": true },
  "azure": { "baa": true },
  "vertex": { "baa": false }
}
```

List every model with at least one BAA-covered route:

```bash theme={null}
curl -s https://api.concentrate.ai/v1/models \
  | jq -r '.data[] | select(any(.providers[]; .baa == true)) | .slug'
```

You can also browse them without the API:

* [Model Fortress](https://concentrate.ai/models?baa=true) with the BAA-eligible filter on
* The [covered models table](https://concentrate.ai/hipaa-llm-gateway#covered-models), with the rate for each route

On a HIPAA-enabled organization you don't need to pin providers. Routing already skips every route where `baa` is `false`.

## Provider certifications

Concentrate's SOC 2 report covers Concentrate. It does not extend to the model provider that serves a request. Each provider holds its own certifications, and not every provider holds SOC 2.

### Check a provider

Every provider entry in the Models API has a `certifications` array. It lists the certifications Concentrate has on record for that provider. An empty array means none are on record.

| Value | Certification |
| - | - |
| `soc2_type1` | SOC 2 Type I |
| `soc2_type2` | SOC 2 Type II |
| `iso27001` | ISO/IEC 27001 |
| `iso27701` | ISO/IEC 27701 |
| `iso42001` | ISO/IEC 42001 |
| `fedramp` | FedRAMP |

List every provider with its certifications:

```bash theme={null}
curl -s https://api.concentrate.ai/v1/models | jq -r '
  [.data[].providers[]] | unique_by(.provider_slug)[]
  | "\(.provider_slug): \(.certifications | join(", "))"'
```

To browse without the API, filter [Model Fortress](https://concentrate.ai/models?certifications=soc2_type2) by certification.

### Keep requests on providers you approve

No setting filters routing by certification. To keep requests on the providers you approve, name them:

* **For an organization, team, or key:** set a [model access policy](https://concentrate.ai/features/model-access-policies). It is an allowlist of models and providers. Fallbacks stay inside the list, and a request with no permitted route is rejected.
* **For a single request:** pass `routing.provider.whitelist`. See [Routing](https://concentrate.ai/docs/api-reference/endpoint/auto-routing.md).

```json theme={null}
{ "routing": { "provider": { "whitelist": ["openai", "azure"] } } }
```

### Providers as sub-processors

Model providers are sub-processors under the [Data Processing Addendum](https://concentrate.ai/legal/data-processing-addendum). The DPA covers them as a group, names several, and makes the current list available on request. [List Providers](https://concentrate.ai/docs/api-reference/endpoint/list-providers.md) returns every provider Concentrate can route to.

## Reports and agreements

> [card] [Trust Center](https://trust.concentrate.ai/)
>
> Security program overview and SOC 2 Type II report requests under NDA

> [card] [Data Processing Addendum](https://concentrate.ai/legal/data-processing-addendum)
>
> Data processing terms for GDPR, UK GDPR, CCPA/CPRA, and other privacy laws

> [card] [Privacy Policy](https://concentrate.ai/legal/privacy-policy)
>
> How Concentrate handles personal data, and its security measures

> [card] [Terms of Service](https://concentrate.ai/legal/terms-of-service)
>
> The terms that govern your use of Concentrate

For anything this page doesn't answer, email [support@concentrate.ai](mailto:support@concentrate.ai).

## Related Documentation

> [card] [Zero Data Retention & Logging](https://concentrate.ai/docs/api-reference/endpoint/zero-data-retention.md)
>
> ZDR, request logging, and organization-level enforcement

> [card] [Guardrails & Redaction](https://concentrate.ai/docs/api-reference/endpoint/guardrails-redaction.md)
>
> Redact PII, PCI, and PHI from requests and responses

> [card] [Get Model](https://concentrate.ai/docs/api-reference/endpoint/get-model.md)
>
> Per-provider `baa`, `zdr`, and `certifications` for one model

> [card] [Routing](https://concentrate.ai/docs/api-reference/endpoint/auto-routing.md)
>
> How routing selects providers