Promantra.ai operates under HIPAA-compliant processes and is certified to ISO 9001 (quality management) and ISO 27001 (information security management) standards. These aren’t marketing badges — they shape how every workflow and dataset is handled.
ISO 9001 governs how we manage quality across every engagement — consistent processes, documented procedures, and continuous improvement rather than ad hoc, one-off delivery. ISO 27001 governs how we manage information security — access controls, risk assessment, and incident response procedures that meet an internationally recognized standard, not just our own internal policy. Together with HIPAA-compliant handling of protected health information, these three form the compliance foundation every engagement is built on.
We’re happy to share our certification documentation directly with your compliance or security team as part of any procurement or vendor review process — we treat that kind of scrutiny as a normal, expected part of working in healthcare, not an inconvenience.
Every engagement follows strict data handling protocols: access controls, encryption in transit and at rest, and de-identification where required. Data is never used beyond the scope of the engagement it was provided for.
Before any data changes hands, we agree in writing on exactly what data is being shared, how it will be used, who on our team can access it, and how long we’ll retain it. Access is limited to the team members actually working on your engagement, and data is never repurposed for another client or another use case without your explicit agreement.
We also conduct regular internal reviews of our own data handling practices, independent of any specific client engagement, to make sure our actual day-to-day practice continues to match our documented policies as our team and our tooling evolve.
Security isn’t only technical. Our human-in-the-loop model means qualified experts review AI outputs before they reach production systems — an added layer of protection against errors that pure automation can miss.
A purely automated system can fail silently — processing thousands of records incorrectly before anyone notices a pattern. Human review at key checkpoints catches exactly the kind of subtle, systemic error that automated monitoring alone tends to miss, which is why we treat it as a security control, not just a quality measure.
This is also why we resist fully removing humans from any workflow, even one that has performed reliably for months. A model’s environment — the payers it processes, the document formats it sees, the rules it operates under — keeps changing, and an occasional human check remains the most reliable way to catch a change before it becomes a systemic problem.
Compliance isn’t a fixed destination — payer requirements, security standards, and regulatory expectations keep evolving, and so does our program.
We continuously invest in expanding our certifications and tightening our practices as our client base and the regulatory landscape grow, and we’ll always tell you plainly and specifically which certifications we currently hold rather than implying coverage we don’t yet have.
If your organization has specific compliance or security requirements beyond what’s listed here — a particular framework your industry requires, or a specific contractual data-handling clause — we’re glad to discuss those directly as part of scoping any engagement.