Hedy Is Now SOC 2 Type I and HIPAA Compliant
Hedy completed independent SOC 2 Type I and HIPAA audits in April 2026. Here is what that means for how your data is protected.
Hedy is now SOC 2 Type I and HIPAA compliant. We put Hedy through independent SOC 2 Type I and HIPAA audits, both completed in April 2026. For a privacy-first product built by a small team, meeting the security bar that enterprise buyers expect from much larger vendors is a milestone worth marking.
What did Hedy complete?
Two independent audits:
- SOC 2 Type I: an independent review of Hedy’s security controls.
- HIPAA: an independent assessment of how Hedy handles health information as a Business Associate.
Both are independent confirmation of the privacy and security work Hedy is already built on.
What does this mean for you?
Day to day, what you rely on doesn’t change. Speech recognition runs on your device by default, and AI analysis can too. Your audio never leaves your control unless you choose to share it, cloud AI analysis stays transient and is never stored or used to train models, and we never sell your data.
What’s new is the proof. If your security review asks for SOC 2, the report is ready. If your organization needs a Business Associate Agreement before using Hedy, we can sign one.
What else protects your data?
This sits alongside everything Hedy already does to protect you: a full GDPR framework, EU data residency, and on-device speech recognition. The SOC 2 Type I and HIPAA reports are available to customers and prospects through our Trust Center, or reach the security team at security@hedy.bot. You can see it all on our security page.
Your most sensitive conversations deserve real protection. Now that protection is independently verified.
About the author
Julian Pscheid is the founder and CEO of Hedy AI, an AI visit assistant used by tens of thousands of patients, caregivers, and professionals worldwide. He writes about how AI is changing the way people prepare for, capture, and understand important conversations.
