Security
Security and HIPAA alignment
HIPAA aligned. Built with privacy and security controls for healthcare data.
This page says what our website does with your data and names every outside provider that handles it. We only list what we can show you.
By Muhammad Aashir Tariq · Founder & Head of Engineering, Afnexis · Updated September 2026
How we build
- The workflow audit uses no PHI.
- Access to production data is limited to named engineers and logged.
- Every agent build includes audit logs and human review for high-risk steps.
We do not claim SOC 2. We do not claim HIPAA certification, because no such certification exists.
What this website collects
Forms
What you type into a form reaches our team as an email. This website has no database of its own, so nothing else is kept.
Chat
The chat keeps your conversation in the page. It's gone when you reload. If you share an email address or phone number, the last six messages are emailed to our team so we can reply.
Analytics
We count page views and a few button clicks without cookies. There are no advertising pixels and nothing follows you to other sites.
Payments
Stripe takes the payment on its own page. We never see or store your card number.
Security controls on this website
- Every page is served over HTTPS, and browsers are told to refuse plain HTTP (HSTS).
- A content security policy limits which outside services can load in your browser.
- The contact forms and the chat run a bot check and are rate limited. The chat also caps message length.
- The healthcare demo is a demo. It asks you not to enter patient details and is instructed to refuse them.
Subprocessors
Seven providers handle visitor data for us. If we add one, it's listed here and in our privacy policy.
| Provider | What it does | What it receives |
|---|---|---|
| OpenAI | Language model behind the website chat and the healthcare demo chat | The messages you type, with the conversation so far. Not your email, IP address, or the page you're on. |
| Tavily | Web search for the chat assistant | A short search query the assistant writes from your question. No name, email, or IP address. |
| Zoho Mail | Email delivery | What you submit in a form, contact details you share in the chat with the last six messages, and the confirmation email we send you. |
| Google reCAPTCHA | Bot check on forms and the chat | Your IP address and browser and device details. Google may read or set its own cookies. |
| Cal.com | Booking calendar | What you enter when you book: name, email, time zone, and notes. |
| Stripe | Payments, including the $1,500 workflow audit | Payment details, name, email, and billing address. Card numbers never reach our servers. |
| Vercel | Website hosting and analytics | Each request: IP address, browser type, and the pages you ask for. Analytics run without cookies. |
Report a security issue
Email info@afnexis.com. We reply within one US business day.
Questions about a project? See how we build custom AI agents, read the privacy policy. For how browsers enforce HTTPS, see MDN's guide to HSTS.