Security & data handling

Last updated November 4, 2026

Accounting, legal, and medical practices handle some of the most sensitive data there is. This page explains plainly how we handle it during an implementation, and where we stand on certifications, so you can decide whether we're the right fit before you share anything.

Where we stand

Procella AI is a small, early-stage firm. We are not currently HIPAA-certified or independently security-audited. (There is no official government HIPAA certification; some firms buy third-party HIPAA assessments, and we have not had one.) We would rather tell you that up front than imply otherwise.

How we handle your data

• We work inside your existing tools. We configure and build within the compliant systems your practice already uses, such as your practice-management, accounting, or EHR software, rather than moving your data into new, unvetted infrastructure.
• Contracts before data. If your engagement requires a signed Business Associate Agreement (BAA) or a similar contractual safeguard, we put it in place before any relevant data is touched.
• Established providers. Where an implementation uses an outside AI or automation service, we use established, reputable third-party providers.
• You approve before we build. In week 2 we present an implementation plan covering which workflows we'll automate, what tools we'll use, and how they integrate with your existing systems. You approve it before we build anything.

Before an engagement

The free audit and strategy call don't need any patient, client, or financial account data, and please don't share it there. The audit asks only general questions about how your practice operates. See our Privacy Policy for what the website and strategy calls collect and which providers process it.

Questions

If your practice has a security questionnaire or specific compliance requirements, send them to sales@procellaai.com.