What we hold, and what we don’t
| Standard | Status | Note |
|---|---|---|
| SOC 2 Type II | IN PROGRESS | Platform built to SOC 2 controls. Certification underway. We are not certified today. |
| GDPR | IN PLACE | GDPR-aligned processing. Standard Contractual Clauses and the UK IDTA used for transfers. DPA available on request. |
| ISO 27001 | NOT YET | Not currently held. |
| HIPAA BAA | NOT YET | RocketMSL is not designed to process patient-identifiable data. Where protected health information is processed on behalf of a covered entity, it is only under a Business Associate Agreement. |
| 21 CFR Part 11 | IN PROGRESS | Audit trail and record-integrity controls in place. Full validation not yet completed. |
| BIPA and state biometric law | IN PLACE | Voiceprints processed only under separate explicit opt-in consent, with a published retention schedule. |
We would rather tell you this now than at the end of a procurement cycle.
Controls in place today
| Control | What it means |
|---|---|
| Encryption | AES-256 at rest, TLS in transit. Applies to recordings, transcripts and derived intelligence alike. |
| Tenant isolation | Every record is scoped to the licensing organisation. Isolation is enforced in the query, not only in the interface. |
| Role-based access control | Enforced at the API layer, not hidden in the UI. Super Admin, Admin, Manager, MSL and Viewer roles, configurable per deployment. |
| Audit trail | Permission-gated and state-changing actions are written to an audit log with actor and timestamp. |
| Hosting | Amazon Web Services. Database, vector-search and cache components run inside our AWS environment. |
| Data residency | Data is processed in the United States. For EEA and UK customers, transfers rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision. |
Your conversations do not train anyone’s model
- Scientific content, transcripts and insights are not used to train foundation models. Content is submitted under a no-training configuration
- Model outputs are grounded in your approved content. Where the platform cannot answer from approved material, it escalates rather than generating an answer
- Scoring and knowledge assessments are decision-support for human review. They are not automated decisions with legal or similarly significant effects
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Amazon Web Services | Cloud hosting and storage |
| OpenAI | AI and LLM processing of audio and text |
Changes to this list are notified in advance under our Data Processing Agreement.
Nothing is recorded without the HCP agreeing to it
Recording consent is captured before any scientific interaction is recorded, and it determines what happens next. With consent, the conversation is captured and analysed. Without it, the MSL completes a structured post-meeting record instead — the same intelligence, entered by hand.
- Consent is captured per meeting, not once per HCP
- The gate is enforced in the application, not by policy alone. Where consent is declined, no audio is captured and nothing is transmitted to any third party
- Consent status is stored on the interaction record and visible in every downstream report
How long we keep things
| Data | Retention |
|---|---|
| Audio recordings | Deleted after analysis, per customer configuration — unless linked to a safety or pharmacovigilance signal requiring longer retention by law |
| Transcripts and derived insights | Duration of the customer relationship, plus up to 90 days |
| Voiceprints | Deleted within 30 days of consent withdrawal, and within three years of last interaction |
| Account data | Deleted within 90 days of account closure |
Signals are detected and routed, not buried in a transcript
Adverse events, product quality complaints, off-label questions and medical information requests are identified in the interaction record and routed into your own internal process. RocketMSL structures and escalates the signal; your approved workflow decides what happens next.
- Adverse events
- Product quality complaints
- Off-label questions
- Medical information requests
Routing is configured to your SOPs during implementation. We do not assume a process on your behalf.
What we can send your security team
- Data Processing Agreement
- Security architecture overview
- Sub-processor list
- Biometric data policy and retention schedule
Found something?
Report security issues to privacy@rocketmsl.com. We will keep you updated until the issue is resolved. We do not pursue researchers who report in good faith.
Talk to us before procurement does
We would rather answer your security team’s questions early than discover them late. Send us your questionnaire and we will work through it.