Security and privacy
Your documents stay yours — and only for a few hours.
Built to support your HIPAA obligations.
Step 1: Uploaded
Encrypted on the way in
Step 2: Worked on
Seen only by your organization
Step 3: Downloaded
By you, to your system
Step 4: Deleted
After 4 hours, or when you finish
What your IT team will ask
How long do you keep our files?
A packet and everything made from it are deleted automatically after 4 hours, or straight away when you finish.
Can another organization see our documents?
No. Each organization's documents are kept apart at the database level, so no one else can ever see your files.
Is everything encrypted?
Yes — in transit and at rest.
Who can sign in?
Only the people your admin invites. Everyone uses their own account with a second factor, and roles separate admins from staff.
Do you sign a BAA?
Yes. Your organization accepts our Business Associate Agreement in the app before the first upload.
Where is it hosted?
On Amazon Web Services, in the United States.
Is our data used to train AI?
No. SortLeaf doesn't use your files to train anything.
Business Associate Agreement
Accepted in the app before your first upload.