Built for the InfoSec review.
InVision processes protected health information on behalf of the health systems that deploy it. This page collects what your security, privacy, and compliance teams ask for, in the order they usually ask for it.
Certifications and attestations
InVision maintains the three programs a hospital's security and quality teams look for: an independent controls attestation, a medical-device quality management system, and HIPAA safeguards.
SOC 2
Third-party audited controls governing the security and availability of the systems that process customer data, supported by annual cybersecurity reviews and penetration testing.
ISO 13485
Quality management system for the design and manufacture of medical devices — the framework under which our cleared software is developed, validated, and released.
HIPAA
Administrative, physical, and technical safeguards for protected health information, executed under a business associate agreement with each covered entity.
How PHI moves through the system
InVision is post-processing software. It reads studies your lab has already acquired and returns structured output; it does not acquire images, and it does not sit in the acquisition path.
| Stage | What happens | What leaves your network |
|---|---|---|
| IntakeDICOM routing | Completed studies route to InVision from your PACS, CVIS, or modality using standard DICOM. | On-premise: nothing. Cloud: the study, over an encrypted channel. |
| AnalysisCleared algorithms | Precision LVEF and Precision Cardiac Amyloid analyze the study and produce measurements and flags. On-premise, all inference runs locally. | Nothing beyond the deployment boundary you chose. |
| ReturnStructured results | Results return to your reporting workflow for a cardiologist to review, edit, and sign. | Nothing. Output lands back in your systems. |
| DeletionNo image retention | In an on-premise deployment, no image data is retained once processing is complete. | Nothing. |
| MeteringBilling and QC metadata | Study metadata — date, accession number, age, sex, billing codes selected, limited or comprehensive study, workflow timestamps, and reported study quality — is sent to InVision for invoice tracking and quality control. | Metadata only. No images. Held on encrypted InVision servers in the US. |
| AccountabilityEdit trail | Every report records what the model proposed and what the physician changed. | Nothing. |
Data residency and the on-premise option
Where PHI lives is a procurement and security decision, and InVision supports both answers with the same cleared algorithms.
On-premise
InVision runs inside your data center, behind your firewall, under your access controls.
- PHI never leaves your network.
- All inference runs locally; no image data is retained after processing.
- Your existing firewall and security infrastructure do not need to change.
- Model versions are pinned and updated on your change-control schedule.
Validated cloud
InVision runs in our validated cloud environment, with studies transferred over an encrypted channel.
- No local infrastructure to provision or maintain.
- Hosted on AWS, within your geographic region in the United States.
- Covered by the SOC 2 scope and your executed BAA.
- Faster to stand up when data-center capacity is constrained.
Security controls
The controls below apply to InVision's own infrastructure. In an on-premise deployment they sit alongside the controls your organization already enforces on the host — they do not replace them.
Access
Role-based access control, least-privilege access, and multi-factor authentication.
Auditability
Audit logging across systems that process customer data, plus a complete edit trail on every clinical report.
Assurance
Annual cybersecurity reviews, penetration testing, third-party SOC 2 audits, and secure software development practices.
As an FDA-cleared Software as a Medical Device, InVision also carries the post-market obligations of a device manufacturer: formal complaint intake and handling, adverse event evaluation and reporting, model performance monitoring, and version control for any approved algorithm update — governed under our ISO 13485 quality management system. Our cleared algorithms are static and cannot be modified without a new FDA clearance, so a model cannot change underneath you.
HIPAA and the business associate agreement
When InVision processes PHI on behalf of a covered entity, it does so as a business associate under an executed business associate agreement. The BAA governs permitted uses and disclosures, the safeguards InVision applies, breach notification obligations, subcontractor flow-down, and the return or destruction of PHI at termination.
An on-premise deployment can change this analysis materially — if no PHI is disclosed to InVision, the relationship your counsel needs to paper may be different. We will work from your paper or ours.
Subprocessors
An on-premise deployment involves no InVision subprocessors in the PHI path — inference runs on your own host and no image data leaves it. For cloud deployments, InVision's infrastructure is hosted on Amazon Web Services in the United States. A current list of subprocessors that may process customer data, including purpose and country of processing, is provided as part of the security review package below, and customers are notified of changes under the terms of their agreement.
Vulnerability disclosure
InVision welcomes reports of suspected security vulnerabilities in its products and infrastructure from good-faith security researchers. Reports are triaged by our security team, and reporters receive acknowledgement and status updates through remediation.
Send reports to contact@invisionmedtech.com. Please include enough detail to reproduce the issue.
Please do not include protected health information in a report, and please do not access, modify, or exfiltrate data that is not yours.
Request the security review package
SOC 2 report, subprocessor list, architecture and data-flow documentation, and our completed security questionnaire — available to prospective and current customers under NDA.