Built with boundaries—not empty promises.
Evidenote uses practical safeguards for its founding pilot while being direct about what has not yet been certified.
Controls in place
- Private, authenticated agency workspaces
- Secure, HTTP-only session cookies
- Server-side payment and AI credentials
- Agency-scoped configuration data
- Rate-limited AI review
- Human review required for AI output
Pilot limits
- No PHI or client-identifying data
- Not an EHR or system of record
- No HIPAA-compliance claim
- No SOC 2 certification claim
- No substitute for clinical or legal judgment
- No emergency or safety-critical use
Our rollout rule
Protected health information stays out until the required technical, contractual, insurance, and legal safeguards are completed and approved.
Security information last updated July 20, 2026