What can we review first?
Architecture, intended use, input/output boundaries, reviewer actions, sample strategy, hosting constraints and acceptance criteria - all without patient data.
Lightweight due diligence
Clear answers before sensitive access.
This questionnaire separates present operating boundaries from controls that must be designed and evidenced for a particular engagement. It is a discovery artifact, not a certification, audit report or substitute for customer due diligence.
Effective September 8, 2026
AreaStatusCurrent answer
Intended use
Current
Decision support for qualified reviewers. No autonomous diagnosis, final coding or claim submission.
Public demo data
Current
Synthetic information only. The public demo and repository are not designed for patient data.
Website forms and email
Current
Do not submit PHI, credentials or patient documents through the website or introductory email.
Real-data evaluation
Project decision
Begins only after purpose, minimum data, authority, hosting, access, retention and deletion are agreed.
Deployment
Project decision
A controlled KamiBridge environment or a customer-controlled environment may be evaluated based on scope.
Access control
Project decision
Roles, administrative access, authentication, least privilege and review responsibility are defined for the deployment.
Encryption and key ownership
Project decision
Transport, storage, backup and key requirements are documented before any approved real-data use.
Logging and provenance
Project decision
Required source provenance, reviewer actions, administrative events and retention are defined for the workflow.
Models and subprocessors
Project decision
Any model, cloud, storage or support provider that may process approved data must be disclosed before use.
Retention and deletion
Project decision
The shortest useful retention period, backup handling, deletion evidence and end-of-engagement steps are agreed in writing.
Incident responsibilities
Project decision
Notification contacts, severity, containment, evidence preservation and contractual responsibilities are defined before production.
Independent assurance
Not claimed
KamiBridge does not currently claim SOC 2, ISO 27001, HITRUST or HIPAA certification on this public site.
BAA or regulated contract
Not pre-approved
Availability and suitability must be evaluated for the specific parties, data flow, jurisdiction and deployment.
Accuracy and compliance guarantee
Not claimed
A pilot result is limited to its sample and acceptance criteria; it is not a blanket accuracy, reimbursement or compliance guarantee.
Can this questionnaire prove compliance?
No. Compliance depends on the parties, jurisdiction, use case, contracts, actual controls and evidence. This page only makes the current discussion boundary explicit.
How should a security concern be raised?
Email doudou@kamibridge.com with a high-level description and no patient data, credentials or confidential attachments. A suitable follow-up channel can then be agreed.
Review one bounded workflow
Start with synthetic information and identify the controls and evidence that would be required before access expands.