Security & Compliance — Peyton AI®
Peyton AI® handles protected health information and privileged legal work product. Our platform is designed to meet HIPAA and GDPR requirements, with controls appropriate for law firms, insurers, and healthcare organizations.
Data Protection
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access controls and least-privilege defaults.
- Comprehensive audit trails for every document access and analysis event.
- Customer-controlled retention and deletion.
HIPAA
Peyton AI® is designed to meet HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements. Business Associate Agreements (BAAs) are available for covered entities and business associates.
GDPR
Peyton AI® is designed to meet GDPR requirements, including lawful basis for processing, data subject rights, and cross-border transfer safeguards. A Data Processing Agreement is available at /data-processing-agreement, and our current sub-processors are listed at /sub-processors.
AI Transparency
Peyton AI® is a generative artificial intelligence triage assistant. It is not a licensed medical professional, a law firm, or a natural person. All outputs must be reviewed and verified by a qualified natural person before any professional action is taken, in accordance with the EU AI Act (2026) and applicable US state laws.
Vulnerability Disclosure
Report security issues to jesse@peytonai.com. See also /.well-known/security.txt.
Disclaimer: Peyton AI® is a technology company and is not a law firm. Peyton AI® does not provide legal or medical advice. Reports support — but do not replace — professional judgment.