Linc captures how your teams work, from documents to screen recordings and interviews. This page shows how we protect that information: our audits, the controls we run every day, and the documents your security team can review.
Independent auditors test our controls, and we hold ourselves to the safeguards required for health data.
Sensiba LLP examined our controls over a three-month period and issued an unmodified opinion with no exceptions noted.
We run the administrative, physical and technical safeguards the HIPAA Security Rule requires, so healthcare teams can use Linc with protected health information.
Casco tested the Linc web application and API in May 2026 and independently verified our remediation in June 2026. We repeat third-party testing every year.
Our reports and policies are shared under NDA. Request access once: after we approve, you'll get a private link to download the documents, one at a time or all together as a zip.
73 controls in place across six areas. Controls covered by our SOC 2 Type II examination were tested by Sensiba LLP.
No controls match that search.
Production runs on AWS, Google Cloud, Neon, Render and Vercel, which secure the physical data centers and their environments.
Production systems, network devices and support tools can only be accessed with an individually assigned account.
MFA is required to access sensitive systems.
New access is approved during onboarding or by the system owner before it is provisioned.
Access to critical systems is reviewed every quarter and adjusted where needed.
Only approved communication channels and protocols can reach production systems.
Internal services and workers run on a private network with no public exposure.
Inbound traffic passes through a firewall with rate limiting, bot detection and DDoS mitigation.
AWS GuardDuty, Google Cloud Security Command Center and Render IDS monitor the environment continuously.
Web traffic and suspicious activity are logged, with automatic alerts on anomalous behavior.
Monitoring tools notify the right people about events, and incidents are escalated according to policy.
User authentication and administrative sessions are encrypted in transit.
Production data is backed up daily, and backups are monitored for completion.
The production database supports point-in-time recovery from automated backups.
Critical components are replicated across multiple availability zones to keep the service available.
Sign in with Microsoft Entra ID, Google Workspace, or your SAML or OIDC identity provider.
Organization and project roles control what each person can see and do, including administrators.
Sessions use secure, HTTP-only cookies with a configurable expiry.
Organization admins can view and export an append-only record of sign-ins, data access and admin changes.
Code and dependencies are scanned continuously, and findings are fixed based on risk and impact.
An independent firm tests the application every year, and remediation is verified.
Written procedures govern how changes are tracked, tested, approved and validated.
Every change is reviewed and tested for quality and security before it is merged.
Releases are approved by authorized personnel before they reach production.
All source code is version-controlled, so any release can be rolled back.
Development and testing happen in environments isolated from production.
HSTS, Content Security Policy and related headers are enforced on the web application.
Customer data is encrypted at rest with AES-256.
All connections use TLS 1.2 or higher.
Each organization's data is kept separate at every layer: database queries, file storage, search indexes and compute.
A data classification policy defines the types of confidential information we hold and how each is protected.
Written retention periods apply to all confidential information we maintain.
Your content stays until you delete it, and organizations can set shorter retention periods.
On request we delete an organization's content from our database, file storage and search index, and provide a deletion certificate.
Session replay masks all inputs and on-screen text before anything is captured.
A DPA with Standard Contractual Clauses for international transfers is available to every customer on request.
We sign BAAs with customers and hold BAAs with the subprocessors that process PHI.
Our subprocessors are listed below, and customers are notified of changes as set out in their data processing agreement.
Your content is never used to train AI models, and our agreements with AI providers prohibit it.
Content passes through PII detection and redaction before it reaches generative AI models. You choose what gets redacted.
Our independent penetration test covered prompt injection and misuse of AI tools and agents.
AI providers work under agreements that prohibit retaining or reusing customer data.
A written policy governs how AI systems are selected, approved and monitored.
Every AI system and model provider we use is inventoried and reviewed.
Employees follow a policy on approved AI tools and how they may be used.
New hires complete background or reference checks, as permitted by local law.
Every employee accepts a management-approved handbook when they join.
Employees accept a policy that sets out how company systems and information may be used.
Information security policies are approved by management, available to all staff and accepted at hire.
All full-time employees complete security training every year.
Management assigns clear roles for running the information security program.
An organization chart sets out roles, responsibilities and reporting lines.
Every role has a written description of the skills and experience it requires.
When someone leaves, their devices, information and system access are revoked promptly.
Company laptops use full-disk encryption to protect stored data and credentials.
Workstations run antivirus software to protect against malware.
Mobile device management tracks inventory and patch status, enforces encryption and supports remote wipe.
Hardware that held sensitive data is disposed of following a written procedure.
A formal process sets risk tolerances and evaluates risks against identified threats.
Threats to the system are identified and ranked every year.
Findings from risk assessments are tracked to resolution through a formal plan.
Risk assessments consider the potential for fraud, including misuse by insiders.
Third parties must meet our data protection requirements before and during engagement.
We keep a directory of key vendors and review critical vendors' compliance reports every year.
Defined responsibilities and procedures ensure a quick, orderly response to security incidents.
Incidents are logged, classified and tracked to resolution, with lessons learned applied.
Incident response plans are tested every year.
A recovery plan sets out roles, responsibilities and detailed procedures for restoring systems.
Defined procedures guide how we respond, recover and resume operations after a disruption.
Business continuity and disaster recovery plans are tested every year.
Control owners review the control framework every year to confirm it operates as described.
Our security commitments and responsibilities are set out in formal service agreements.
Customers and researchers can report security, availability or confidentiality concerns directly to our team.
These companies help us deliver Linc. Each is bound by a data processing agreement, and customers are notified of changes as set out in their own DPA.
| Company | Purpose |
|---|---|
| Amazon Web Services | Encrypted file and recording storage |
| Vercel | Web application hosting, edge network and file uploads |
| Render | Backend services, background workers and private networking |
| Neon | Managed PostgreSQL database |
| Pinecone | Vector search over redacted content |
| Modal | Isolated compute for analysis and redaction |
| Microsoft Azure | Document and image text extraction |
| OpenAI | Embeddings and language model processing of redacted content |
| Anthropic | Language model analysis of redacted content |
| Google Cloud | Video and multimodal analysis of redacted content |
| Deepgram | Speech-to-text and text-to-speech |
| Recall.ai | Meeting recording for interviews, when enabled |
| Sentry | Application error monitoring |
| PostHog | Product analytics with fully masked session replay |
| Resend | Transactional email |
Yes. Sensiba LLP completed a SOC 2 Type II examination of the Linc AI platform covering Security, Availability and Confidentiality for May 19 to August 19, 2026, and issued an unmodified opinion. You can request the full report above.
Yes. Linc is HIPAA compliant and signs BAAs with customers that handle protected health information. Subprocessors that process PHI are covered by executed BAAs.
No. Customer content is never used to train AI models, and our agreements with every AI provider prohibit retaining or reusing it.
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Each organization's data is isolated at every layer of the platform, and personal information is redacted before content reaches generative AI models.
Yes. Linc supports Microsoft Entra ID, Google Workspace and SAML or OIDC identity providers, so your MFA and conditional access policies apply.
Yes. You can delete content at any time, and on request we delete an organization's content from our database, file storage and search index and provide a deletion certificate.
Email security@linc-ai.com. We acknowledge reports within 48 hours.
Questions about a questionnaire, a document or how Linc handles your data? We're happy to help.
