Security review

This page is the public summary for a privacy, security, or procurement reviewer. It states what is available and what is chosen per deployment. Detailed artifacts are not published here. They are shared under NDA or during an active procurement review, on the controlled pages linked below.

HIPAA

Spryng runs a HIPAA-aligned program. A BAA template is available.

What you can request

HECVAT 4.1.6 is available on request. Spryng does not publish a score or a percentage from that questionnaire.

AI. How AI risk is managed is on the AI risk policy. Spryng's AI-assisted features are transcription, translation and redaction of responses, and the optional AI Pattern Synthesis add-on. Each is optional and is turned off for your organization on request. An account owner can ask us to turn any of them off for their organization by emailing privacy@spryng.io, and we confirm in writing when it is done. Turning off AI redaction does not turn off rule-based redaction.

Sub-processors. The list is the existing data subprocessor page. It is shared under review rather than reproduced on this page.

Hosting region. The hosting region is chosen for each deployment. The default is an AWS region in the United States. Another AWS region, such as Canada (Central), can be chosen for that deployment. A public page is not a promise that every deployment uses one region.

Security and privacy policies. Spryng has adopted seven security and privacy policies. Copies are available on request with the review package. This page does not publish the policy texts. Policies published on the site are the Privacy Policy, the Cookie Policy, and the AI risk policy.

Penetration testing. An independent third party tests the application every quarter. This page states that cadence only. It does not describe findings, severity, or remediation. The controlled summary is the security testing page.

CSA STAR Level 1. Spryng has completed a CSA STAR Level 1 self-assessment, CAIQ v4.1. The listing is on the CSA STAR Registry. A Level 1 self-assessment is the provider's own answers. It is not a third-party certification.

Controlled documents in the review package

These routes stay up so an existing citation lands somewhere. The documents themselves are not published on the marketing site:

The Trust Center is the shorter public index of the same package.

How to ask

Email security@spryng.io with your organisation and the review stage you are in, or start a conversation. Initial triage is within 2 business days. Delivery of the package follows your procurement stage and a mutual NDA.