Your data never trains a model.
Every request for your data is approved, expires on its own, and leaves an audit trail.
HITRUST i1 · SOC 2 Type 2 · Annual HIPAA audit · Annual penetration test
Audited every year.
Certifications are public, and reports are available on request.
HITRUST i1Certified · the letter is public
SOC 2 Type 2Unqualified opinion · no exceptions
HIPAAAudited every year · BAAs signed- Penetration testEvery year · OWASP app and LLM standards
Built for regulated healthcare data.
- 01
Isolated by client
Each client is walled off. Its data and findings stay with it.
- 02
Encrypted and segmented
TLS 1.3 in transit, AES-256 at rest. Sensitive data stays out of test environments.
- 03
PHI protections
Set per deployment, so PHI never shows where it should not.
- 04
Never trains a model
Nothing is kept at the model layer. Your data never trains a model.
Four gates on every query.
One question, through each control it passes.
Which denied authorizations still paid this plan year?
pi.analyst@demo-plan.com- pi.analyst@demo-plan.comSigns in
- Payment integrityRole
- Claims and providersWhat the role sees
Only what your grants allow.
ContextBase reads through the service account and grants you set. If a grant does not cover a table, no prompt can reach it.
We give you the exact GRANT commands, and test your row-level security and masks with you before go-live.
Snowflake
Databricks
BigQuery
Redshift
PostgreSQL
SQL Server
Oracle
Teradata
A few of them. See all connectors
Connects on your terms.
Identity, credentials, and network, set up to your team’s standards.
Identity federation
No secret crosses the wire.
Your secrets manager
Credentials stay in your vault, read at runtime.
Private network routes
VPN, PrivateLink, Private Endpoint, VPC peering, or allowlisted IPs.
Validated before production
Four checks, logged, with a report for your team.
Where your data lives.
Your data stays with you, in your own cloud storage or in Google Cloud. ContextBase reaches your systems over the private route your network team picks.
Your environmentQNXT · Facets · HealthEdge
- Claims and eligibility
- Your data warehouse
- Documents and code
- Your secrets manager
Your grants · your credentials
FlumeGoogle Cloud
- Approved knowledge
- Answers and their checks
- Dashboards, apps, and bots
- The audit trail
HITRUST i1 · SOC 2 Type 2
Questions a review asks first.
Where does our data live?
Your data stays with you, in your own cloud storage or in Google Cloud. ContextBase reaches your systems over the private route your network team picks, such as a VPN or PrivateLink.
Does Flume hold our credentials?
Not where it can be avoided. We prefer identity federation, so no secret crosses the wire. Otherwise credentials stay in your secrets manager and are read at runtime.
Can ContextBase change our data?
Bots run read-only by default. Apps declare what they read and what they act on before they run, and database access is approved scope by scope.
Which of our permissions apply?
The grants you set on Flume’s service account. We give you the exact GRANT commands, and test your row-level security and masks with you before go-live.
How is access granted and removed?
Database access is requested with a reason, approved for a set window, and ends on its own. Each person sees what their role allows, privileged accounts use multi-factor authentication, and access is reviewed periodically.
Is there an audit trail?
Yes. Who ran what, against which data, and when, kept as a complete record. Every answer also arrives with the queries it ran, the rows it returned, and its checks.
Can consultants work on our data?
Consulting and implementation firms deliver on Flume inside the same controls. Each client is isolated from every other, and a client’s data and findings stay with that client.
Can we see the reports, or sign a BAA?
Yes to both. We sign a business associate agreement. Certifications are public in the security portal, and the SOC 2 Type 2 report and the HITRUST validated assessment are available on request.
Take Flume through your security review.
We will walk your team through the controls, the reports, and how a deployment is scoped.