Encryption
- In transit: TLS 1.2 or higher for all data moving between your browser, Alcove's functions, and AWS services. Recorded audio uploads directly from your browser to Amazon S3 over HTTPS via a pre-signed URL, so it never passes through Alcove's own application servers.
- At rest: AES-256 encryption for all S3 objects and DynamoDB tables, managed by AWS Key Management Service (KMS).
Alcove is encrypted in transit and at rest. It is not end-to-end encrypted: the note is generated by AI on the server, which necessarily processes the transcript to produce your documentation. Any vendor whose AI writes your note works this way.
Where audio and PHI live
- Audio is stored in Amazon S3 only during processing and is deleted automatically after transcription and AI processing complete, typically within minutes of upload. It is never retained for training, analytics, or research.
- Transcripts are intermediate artifacts in S3, deleted automatically once the SOAP note is generated, and purged within 24 hours even in error or retry states.
- SOAP notes and encounter records are stored in Amazon DynamoDB and retained for the life of your account to support your encounter history.
- AI generation runs on Amazon Bedrock using Anthropic's Claude models, inside AWS infrastructure covered by Alcove's BAA with AWS.
Subprocessors
These are the third-party services that may process data on Alcove's behalf. AWS covers all of its services, including Bedrock, under a single HIPAA Business Associate Agreement. The non-AWS processors below (Resend, Stripe, and Sentry) never receive Protected Health Information.
| Subprocessor | Purpose | Receives PHI? | Safeguard |
|---|---|---|---|
| Amazon Web Services | S3 audio storage, Transcribe Medical (speech-to-text), DynamoDB (encounter data), Bedrock (Claude AI note generation) | Yes | HIPAA BAA in place; AES-256 at rest via KMS; TLS 1.2+ in transit |
| Amazon Bedrock / Anthropic Claude | Generates the structured SOAP note from transcribed text | Yes (transcribed text derived from audio) | HIPAA-eligible, fully under the AWS BAA. AWS contractually prohibits use of customer data for model training under Bedrock terms; Alcove has no direct data relationship with Anthropic. |
| Amazon Cognito | Authentication (email, role, practice identifier) | No | Stores authentication data only, not clinical PHI |
| Resend | Administrative email only (invitations, billing notices) | No | Email content is limited to non-PHI administrative notices; no PHI is ever transmitted by email |
| Stripe | Payment processing and subscription management | No | Receives only billing information (card details, billing address); PCI DSS Level 1 certified. No clinical data is ever transmitted to Stripe. |
| Sentry | Application error monitoring and crash reporting | No | PHI is programmatically scrubbed by Alcove's redaction layer before any error payload is sent; Sentry receives only sanitized stack traces and event metadata. |
Isolation, access, and audit
- Multi-tenant isolation: each practice's data is segregated using composite DynamoDB partition keys, so cross-practice access is architecturally impossible.
- Role-based access: access is scoped by role; a medical assistant role, for example, cannot open finished SOAP notes.
- Authentication: AWS Cognito with practice-scoped attributes, enforcing isolation at the identity layer.
- Audit logging: access to patient records, transcripts, and notes is recorded to an audit log.
Retention & deletion
- Audio: deleted within minutes of processing; never retained beyond the processing window.
- Transcripts: deleted on successful note generation; purged within 24 hours in any error state.
- SOAP notes and encounter records: retained for the life of your account.
Breach notification
As a Business Associate, Alcove will notify affected practices of any breach of unsecured PHI without unreasonable delay and no later than 60 calendar days of discovery, consistent with 45 CFR §§ 164.400–414. Practices, as Covered Entities, remain responsible for notifying affected patients and, where required, HHS. Report a suspected incident to security@alcove.health.
Do you need SOC 2?
A cautious buyer often asks whether a vendor has SOC 2. Here is the honest answer for a HIPAA context:
- What HIPAA legally requires of a vendor that handles PHI is a signed BAA plus the administrative, physical, and technical safeguards of the Security Rule.
- A SOC 2 report is voluntary. It is a useful signal of security maturity, but it cannot substitute for a BAA. Without a BAA you cannot lawfully send PHI to a vendor no matter how strong its controls.
- Alcove provides a BAA to every practice, including the free tier, and implements the safeguards described above. Alcove does not currently hold a SOC 2 report.
See the sources on this distinction from Total HIPAA and Linford & Co.
Common questions
Is patient data encrypted?
Yes. Patient data is encrypted in transit and at rest. Data travels over TLS 1.2 or higher between your browser and AWS services, and is stored with AES-256 encryption managed by AWS Key Management Service (KMS). Alcove does not offer end-to-end encryption, because the note is generated by AI on the server, which necessarily processes the transcript to produce your documentation.
Who are Alcove's subprocessors?
Amazon Web Services (S3 audio storage, Transcribe Medical, DynamoDB, and Amazon Bedrock running Anthropic's Claude models) is covered by a HIPAA Business Associate Agreement that includes Bedrock. Amazon Cognito handles authentication and stores no clinical PHI. Three non-AWS processors never receive Protected Health Information: Resend delivers only administrative email such as invitations and billing notices, Stripe processes billing only, and Sentry receives only PHI-scrubbed error telemetry.
Does Alcove need SOC 2, and does it have it?
HIPAA does not require a SOC 2 report. What HIPAA legally requires of a vendor that handles PHI is a signed Business Associate Agreement (BAA) plus the administrative, physical, and technical safeguards in the Security Rule. A SOC 2 report is voluntary and cannot substitute for a BAA. Alcove provides a BAA to every practice, including the free tier, and does not currently hold a SOC 2 report.
Questions a checklist here does not answer? Email security@alcove.health or review the full Privacy Policy and BAA.