Security & Compliance
Enamly answers phone calls for dental practices, which means we handle protected health information every day. This page describes how that data is protected, who can reach it, and where our compliance program stands. It is written to be useful to the people who actually review vendors: practice owners, security teams, and payers.
Last updated: July 29, 2026
Where we stand
| HIPAA | Enamly operates as a Business Associate. We sign a Business Associate Agreement with every practice before handling any patient data, and we hold BAAs with every subcontractor that touches it. |
|---|---|
| SOC 2 Type II | A SOC 2 Type II audit is in progress with an independent AICPA peer-reviewed CPA firm. The letter of engagement, and the report once issued, are available to customers and prospects on request. |
| Data location | All patient data is stored and processed in the United States on Amazon Web Services infrastructure. We do not transfer patient data internationally. |
| Designated official | Enamly has a formally designated HIPAA Security Official and Privacy Official, appointed in writing with defined responsibilities and the authority to direct spending and halt processing. |
How patient data is protected
Encrypted at rest
Call recordings, transcripts, and any collected insurance details are stored in Amazon S3 and encrypted with AWS Key Management Service using AES-256. Encryption keys are managed in our own AWS account under our Business Associate Addendum with AWS.
Encrypted in transit
Every connection to Enamly, including practice dashboards and the interfaces our phone assistant uses to read and write appointments, is served over HTTPS with modern TLS. Plain HTTP requests are redirected, never served.
Least-privilege access
Application credentials are scoped to only the permissions the service needs, and administrative credentials are held separately. Further detail is available to customers and reviewers on request.
Separated by practice
Each practice's data is isolated and accessible only to that practice's authorized users, enforced at the data layer rather than only in application code.
Audit logging
Administrative activity across our cloud environment is recorded to an encrypted, tamper-evident audit trail and retained in line with our regulatory obligations. Application logs are retained separately and contain no patient health information.
Monitored continuously
Service health and error rates are monitored continuously with automated alerting. Recordings and transcripts move into long-term encrypted archival storage on a defined schedule rather than being kept in active storage indefinitely.
We keep less than you might expect
Our phone assistant needs to understand a caller well enough to book the right appointment. It does not need to build a medical record, and we have deliberately designed the system so that it does not.
- The assistant is instructed never to discuss balances, coverage amounts, or clinical advice, and never to give medical guidance.
- Recordings, transcripts, and insurance details are written to encrypted storage rather than sitting in our general-purpose application database.
- Deleting call records is restricted to a single Enamly-controlled administrative role, so retention obligations cannot be broken by accident.
Who else is involved
Delivering the service requires a small number of infrastructure and technology providers. Every provider that creates, receives, maintains, or transmits protected health information on our behalf is under a Business Associate Agreement with us, as HIPAA requires.
A current list of these providers, what each one does, and whether it handles patient data is available to customers and reviewers on request. Email info@enamly.ai.
If something goes wrong
We maintain a documented incident response process covering identification, containment, assessment, and notification. If a breach affecting protected health information occurs, we notify the affected practice without unreasonable delay and within the timeframes required by HIPAA and our Business Associate Agreement, and we support that practice in meeting its own notification obligations.
Reporting a vulnerability
If you believe you have found a security vulnerability in Enamly, please email info@enamly.ai with the words "security report" in the subject line. Please give us a reasonable opportunity to investigate and remediate before disclosing publicly. We will acknowledge your report and keep you updated. We do not pursue legal action against researchers who report in good faith and avoid privacy violations, service disruption, or data destruction.
Conducting a vendor review?
We can provide a Business Associate Agreement, our SOC 2 letter of engagement, a completed security questionnaire, our subprocessor list, and documentation of the safeguards described above. Email info@enamly.ai and tell us what your process needs.