---
title: "Security & data"
description: "PHI, what the platform holds, encryption, key handling and reporting an issue."
url: https://developer.tendralhealth.com/docs/security
---

# Security & data

What the API protects, how, and what Tendral does not handle.

## Protected health information

Tendral's platform is for healthcare market research. We do not collect, process, or store Protected Health Information (PHI) as defined by HIPAA, and we are not a HIPAA covered entity or business associate. Because we do not handle PHI, our platform operates outside the scope of HIPAA, and we do not enter into Business Associate Agreements. Do not send PHI to the API. See [HIPAA & PHI](https://tendralhealth.com/hipaa-compliance).

## What the platform holds

- Professional credentials and identity-verification data
- Survey responses reflecting clinical opinions and market research
- Aggregated, de-identified research insights
- Account and payment information

## In transit and at rest

The API is served over HTTPS only. Data is encrypted in transit and at rest; database connections use encrypted channels and backups are encrypted.

## API keys

Keys (`tk_live_…`) carry 256 random bits. Tendral stores only a SHA-256 hash of each key, shows a key once at issue, and can revoke a key at once. Each key is limited to its own organization's data and to its scopes. See [Authentication](/docs/authentication).

## Infrastructure

We host the platform with established cloud providers that maintain SOC 2 compliance for their infrastructure. Tendral itself does not hold a formal security certification. For what we collect and who it is shared with, see the [Privacy Policy](https://tendralhealth.com/privacy); more on controls is on [Security](https://tendralhealth.com/security).

## Report a security issue

Write to [security@tendralhealth.com](mailto:security@tendralhealth.com).