Our own work
Our teams follow the policy whenever they use AI for internal work.
Security at thinkbridge.
thinkbridge is ISO 27001 certified. The systems we deliver are built to SOC 2 standards and run in the cloud or on the servers you choose.
Certifications and standards.
- ISO 27001 certifiedA copy of the certificate is available on request.
- Built to SOC 2 standardsWe design and build each client system to these standards.
- Healthcare dataSystems that handle protected health information (PHI) are built for HIPAA and PHI compliance. Your organization remains responsible for its HIPAA compliance program.
How every system is protected.
- Zero-trust access
- Encryption
- Backup and disaster recovery
- High availability
- Full audit trail
Keys you control
Your data is encrypted with keys you create and manage in your own key management service.
Audit trail in your tools
Every action is logged, and the logs can stream to your monitoring tool or SIEM, so your security team can review them in the tools it already uses.
AI model calls
Every task goes to the AI model that handles it best, and every call is monitored. These calls also follow our zero data retention policy.
How we handle data when we use AIBeta releases
You approve each change in a beta release before it goes live.
Put your reviewers in touch with the people who build the systems.
One of our experts will walk them through how a system like yours is secured.
Zero data retention for AI.
We follow a strict zero data retention policy whenever we use AI.
AI providers say they keep customer data out of model training, and we have enterprise plans with them. We don't assume that is true, so the policy applies on those plans too.
Client projects
The same policy applies when we use AI on a client project.
Systems we build
AI features inside a system we build follow the policy too.
What it means
The AI provider keeps no copy of any of these.
- Prompts
- Responses
- Code and files
- Client data
Sign-in and access.
The systems we build connect to the identity provider you already run, so you manage who has access in one place.
Single sign-on
Your team signs in with their existing work accounts and follows the sign-in rules you set in your identity provider.
User provisioning (SCIM)
Accounts are created, updated and removed from your directory automatically. When someone leaves, their access ends with their account.
Works with
Microsoft Entra ID
- SAML
AD FS
And other providers that support SAML 2.0 or OpenID Connect.
All logos and names are the property of their respective owners. They appear here only to identify the identity providers our systems work with, and they do not imply endorsement or affiliation.
Hosting and ownership.
You decide where your system and its data live.
Hosted by thinkbridge
We operate the system and handle updates and monitoring.
In your own cloud
We deploy it to your own AWS, Microsoft Azure or Google Cloud account, as a public, private or hybrid setup, behind your own network controls.
On your own servers
Runs on hardware you operate, in your own facility.
You own what we build
When the term ends, all of it is yours.
- Source code
- Data model
- Business logic
- Your data
What would a system you own cost?
Tell us what you run today, and we'll send a free breakdown of what replacing it would cost within five business days.
A word from our head of security
We check every system's security before anyone else has to. If something slips after go-live, you hear it from us first, with the fix. That's how I'd want my own company's data looked after.
Arun K.N., Associate Director, DevOps
Security questions, answered.
Is thinkbridge SOC 2 certified?
No. thinkbridge is ISO 27001 certified, and the systems it delivers are built to SOC 2 standards. We are in the last steps of getting our own SOC 2 Type II as well.
Is thinkbridge HIPAA compliant?
HIPAA has no certification. thinkbridge builds systems that are ready for HIPAA and PHI compliance, with encryption, zero-trust access, backups and a full audit trail, running in the client's own cloud or on its own servers. thinkbridge does not claim HIPAA compliance for itself. Each client remains responsible for its own compliance program and for how it configures and uses the system.
Who owns the system thinkbridge builds?
At the end of the term the client owns everything we build: the source code, the data model, the business logic and the client's data. The systems run on infrastructure the client chooses and don't need a proprietary runtime or licensing fees.
Is our data used to train AI models?
No. We don't train or fine-tune models on client data, and we follow a zero data retention policy whenever we use AI. The AI provider keeps no copy of a prompt or a response.
Where do thinkbridge systems run?
Wherever the client chooses. We can host it, deploy it to the client's own AWS, Microsoft Azure or Google Cloud account (public, private or hybrid), or install it on the client's own servers.
Does the system support single sign-on?
Yes. Systems connect to your identity provider through SAML 2.0 or OpenID Connect, and SCIM keeps user accounts in step with your directory.
Can we use our own encryption keys?
Yes. Data can be encrypted with keys you create and manage in your own key management service.
Can thinkbridge complete our security questionnaire?
Yes. Send it through the form on this page, and our team replies within five business days.
There's a new way there™.
One of our experts can show you how a system like yours would be built and secured.