Security at DIAL3D.

Summary

DIAL3D operates a security program designed around HIPAA and 42 CFR Part 2. PHI is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is limited, role-based and logged. Multi-factor authentication is available to every admin user.

Infrastructure

DIAL3D production runs on SOC 2-audited cloud providers: AWS for backend services and storage, and a global edge network for web and chat traffic. Customer data is stored in the United States. Edge traffic is served from the location nearest each visitor.

Each customer's data is isolated by tenant. Every request is tied to the signed-in user's organization, and every query is scoped to it, so one customer cannot read another customer's data. We review tenant scoping as part of our security audits.

Encryption

In transit: TLS 1.2 minimum on all customer-facing endpoints, with HTTP Strict Transport Security. Connections from our services to the database use TLS.

At rest: AES-256 for voice recordings, transcripts, and structured PHI. Encryption keys are managed by AWS KMS, and sensitive fields are encrypted again at the application layer.

Database backups are kept for 35 days with point-in-time restore. Our last restore test was in October 2026.

Workforce access

Production access is limited to a minimum-necessary group of workforce members and is role-based. Departing workforce members lose access the same business day.

Activity in our cloud account is logged and retained for six years. Access to PHI in the application is written to an audit log retained for seven years. Continuous threat detection alerts our team to suspicious activity.

Vulnerability management

Every code change runs automated checks and tests before release. We run internal security audits of the platform and fix findings by severity, most recently in October 2026.

Responsible disclosure: security researchers can report vulnerabilities to hello@dial3d.ai. We acknowledge every report and keep the reporter updated until it is resolved.

Authentication for customer admins

Admin users can turn on multi-factor authentication for their accounts. DIAL3D Next uses passwordless sign-in with one-time email codes. Single sign-on (SAML and OIDC) is on our roadmap.

Sessions expire automatically, and sign-in tokens rotate and can be revoked.

Audit logs

Access to PHI is written to an audit log retained for seven years. Logs capture: actor, action, target record, timestamp, source IP, session ID.

Customers can export their audit logs at any time for inclusion in their own HIPAA risk assessment or external audits.

Incident response

DIAL3D maintains a documented incident response plan. In the event of a confirmed security incident affecting customer PHI, we notify affected customers without unreasonable delay and provide the information required to discharge their breach-notification obligations.

Our systems are monitored around the clock, and our team is alerted automatically when something fails. If an incident affects your service, we contact your account owner directly.

Audit + assurance

DIAL3D performs a HIPAA security risk assessment and updates it after material changes to the platform. Customers can request a security questionnaire response and our security overview from hello@dial3d.ai.