WildRun AI — Security & Compliance Brief
wildrunai.com · info@wildrunai.com · Prepared for healthcare and legal procurement review
At a Glance
BAA Available
✓ Included at no charge for covered entities and business associates
Infrastructure Layer
Cloudflare Workers — SOC 2 Type II certified platform (Cloudflare's own cert, shared on request)
Encryption in Transit
TLS 1.3 — all endpoints. Legacy TLS 1.0/1.1 disabled.
Encryption at Rest
AES-256 — Cloudflare D1 (transcripts), R2 (audio), KV (cache)
Data Residency
Cloudflare US data centers. No data egresses to uncontrolled third parties.
PHI in Logs
✗ Never. Only hashed IPs and metadata in log streams.
BAA & HIPAA Controls
| Control | Status / Detail |
|---|---|
| Business Associate Agreement (BAA) | ✓ Signed before any PHI-touching deployment. Covers WildRun AI, Vapi (voice infra), ElevenLabs (TTS), and Cloudflare (hosting). No extra charge. |
| PHI field handling | Call transcripts stored with access restrictions. PHI fields excluded from log streams. Agent scripts reviewed to minimize PHI solicitation. |
| Breach notification | BAA names responsible contact and 60-day notification window per HIPAA Breach Notification Rule. |
| Minimum necessary standard | Voice agent collects only fields required for the specific use case (intake, scheduling, screening). Not generically recorded. |
| No AI training on PHI | ✓ All AI inference is API-only. Anthropic (Claude), Vapi, ElevenLabs terms prohibit training on BAA-covered inputs. WildRun does not opt into any training program. |
| Transcript retention | Default 90 days. Configurable shorter or longer to match client compliance framework (e.g., 6-year HIPAA record minimum on request). |
| Patient data deletion | Full purge within 30 days of offboarding. JSON export available on request before deletion. |
Infrastructure & SOC 2
| Layer | Detail |
|---|---|
| Hosting | Cloudflare Workers (edge compute). No persistent VM — each request is stateless and isolated. Cloudflare holds SOC 2 Type II certification; report available on request from Cloudflare. |
| Database | Cloudflare D1 (distributed SQLite). All queries use parameterized prepared statements — no SQL injection surface. Data encrypted at rest, AES-256. |
| Admin access | API key required. Brute-force lockout: 5 failed attempts → 15-minute endpoint lock (Durable Object-backed, race-safe). No SSH access surface. |
| Webhook integrity | Every inbound webhook (Stripe, Resend, Vapi) verified with HMAC-SHA256 before code executes. No shared-secret fallback in production. |
| WAF + DDoS | All traffic passes Cloudflare's WAF before reaching application layer. Rate limiting at WAF and application layers. |
| CSP headers | Strict Content Security Policy, X-Frame-Options, Referrer-Policy, and frame-src/object-src restrictions on all responses. |
| Dependency surface | Bundle <1 MB. npm audit clean (0 known vulnerabilities as of last deploy). |
Sub-processors
| Vendor | Role | Data / BAA status |
|---|---|---|
| Cloudflare | Hosting, CDN, DB, WAF | SOC 2 Type II. HIPAA-eligible infra. Signs BAA with qualifying enterprise customers. US data centers. |
| Vapi | Voice AI infrastructure | Executes BAA for healthcare deployments. Does not train on call content under BAA. Raw audio retained briefly for QA then purged. |
| ElevenLabs | Text-to-speech synthesis | Paid-plan API terms prohibit training on inputs. BAA available on request for enterprise/healthcare use. |
| Anthropic (Claude) | AI drafting & scoring | API terms prohibit training on customer inputs without opt-in. WildRun does not opt in. No PHI transmitted. |
| Resend | Transactional email | Email metadata only. No call transcript content or PHI in email payloads. |
Requesting the BAA
Email info@wildrunai.com with subject line "BAA Request". We will return a draft BAA template within one business day. The BAA is included in the standard service agreement for any covered entity — there is no additional charge and no minimum contract length requirement to request it.
For a full controls walkthrough with your compliance team, book a 30-minute call at wildrunai.com/book-a-demo.