Patient data
never leaves your cloud.
Qovery runs the control plane. Your workloads, your PHI, your databases stay in your VPC - encrypted with your keys, governed by your policies. We sign the BAA and never touch patient data.
- ✗Metadata-only telemetry
- ✗No PHI in transit or at rest
- ✗Deploy events + config state
- ✗SOC 2 Type II certified
- ✓PHI stays in your VPC
- ✓Encrypted with your KMS
- ✓HDS-certified regions only
- ✓You control all access
Trusted by healthcare teams serving millions of patients
Built for
regulated teams.
Every compliance requirement mapped to a platform capability. No bolt-on features, no checkbox theatre - architecture that passes the audit by design.
We sign the BAA. We never see PHI.
Qovery executes a Business Associate Agreement with every healthcare customer. The BAA covers our control plane operations - which by architecture never process, store, or transmit PHI.
Read the HIPAA whitepaperBusiness Associate Agreement
Parties
This BAA is entered into between Covered Entity (Customer) and Business Associate (Qovery SAS).
Scope of Services
Business Associate provides container orchestration and deployment management services. BA does not create, receive, maintain, or transmit PHI.
Obligations
BA shall maintain SOC 2 Type II certification. BA shall notify CE within 24 hours of any security incident. BA shall provide audit access upon reasonable request.
Data Handling
All PHI remains within CE infrastructure. BA processes only deployment metadata, configuration state, and resource metrics.
We sign the BAA.
We never see your PHI.
- ✗Vendor processes PHI as sub-processor
- ✗Patient data transits vendor infra
- ✗Shared tenancy across customers
- ✗HDS certification burden on vendor
- ✗BAA covers broad data handling
- ✓Qovery never processes PHI
- ✓All data stays in your VPC
- ✓Dedicated clusters, full isolation
- ✓You choose HDS-certified regions
- ✓BAA covers metadata-only operations
Health insurance - HDS + GDPR - $8B valuation
"One platform for every product team - from claims to care pathways - with full EU data residency. Qovery gave us the developer velocity of a startup with the compliance posture of a bank."
~2M patients
"Ship HIPAA-regulated workloads as fast as a startup."
550K+ customers
"Zero downtime during our critical cloud migration."
Billing platform
"New engineers push to production on day one."