Your documents are the whole product. We treat them that way.
Everything you upload is encrypted in transit and at rest, scoped to you, logged on access, and never used to train a model that anyone else touches. The detail below is written for a procurement team, not a brochure.
- AES-256
- Encryption at rest, with keys managed and rotated in AWS KMS
- TLS 1.2+
- Minimum transport encryption for every request
- US only
- All data stored in AWS United States regions
- Never
- Your documents are not used to train or fine-tune any public model
Figures describe how the BillingLens platform is configured. They are not third-party certifications of BillingLens itself; see the compliance section below for what is and is not certified.
Compliance
What we align with, and what we do not claim.
BillingLens is not itself SOC 2 certified. It runs on certified infrastructure, and implements controls aligned to HIPAA and GDPR. The distinction matters, so it is stated plainly.
HIPAA-aligned controls
End-to-end encryption, role-based access control, audit logging, and Business Associate Agreement support. Protected health information is encrypted at rest and in transit, with access policies enforced at every layer.
GDPR principles
Data minimization, purpose limitation and the right to erasure. You can request export or deletion at any time. Our processing agreements define roles, responsibilities and the lawful basis for processing.
Built on SOC 2 Type II services
Our infrastructure runs on SOC 2 Type II certified services, with continuous monitoring, automated alerting and regular third-party audits of the underlying platform.
Controls
Six things protecting your documents.
- Encryption
AES-256 at rest and TLS 1.2+ in transit for everything you upload and everything we derive from it.
Keys rotated automatically in AWS KMS - Access control
Role-based access with multi-factor authentication support. A request that cannot identify its owner returns an error, not rows.
Scoped at the query layer - Audit logging
Every data access and system change is recorded. Records are appended, never edited in place.
Who, what, from what to what, when - Data retention
Documents are kept only as long as the service needs them. You can delete a matter and its files at any time.
Zero-retention agreements available - Incident response
A documented plan with a 24-hour notification commitment, and automated alerting on the systems that would tell us first.
24-hour notification commitment - Protected AI
Analysis runs in isolated, single-tenant infrastructure with no data sharing between customers. Processed, cited, then discarded from model memory.
No cross-customer training, ever
Infrastructure
Where your documents actually sit.
Everything runs on AWS in United States regions. No part of the pipeline stores your documents outside it.
- Amazon S3
Original document storage.
Encryption at rest, strict access policies - Amazon RDS
Metadata and billing records, on PostgreSQL.
Encrypted, private subnet - AWS KMS
Encryption key management.
Automatic key rotation - Amazon CloudWatch
Monitoring and alerting.
Real-time, with automated alarms - AWS WAF
Web application firewall.
DDoS protection at the edge - Amazon VPC
Private network isolation.
No public database access
Security FAQ
Questions from procurement and security teams.
How is my data encrypted?
All data is encrypted with AES-256 at rest and TLS 1.2+ in transit. Encryption keys are managed through AWS Key Management Service with automatic rotation. Database fields holding sensitive information carry additional application-level encryption.
Does my data train your AI models?
No. Your documents are processed in isolated, single-tenant infrastructure and are not used to train, fine-tune or improve any model. Analysis is ephemeral: processed, cited, and discarded from model memory.
Where is data stored?
Exclusively in AWS United States regions. Amazon RDS holds metadata and billing records; Amazon S3 holds original documents. Both are configured with encryption at rest and strict access policies.
Do you retain uploaded documents?
Only for as long as providing the service requires. You can delete your data at any time. Zero-retention agreements are available for enterprise customers.
How does BillingLens cite its findings?
Every finding names its source: a clause in your engagement letter, a published billing guideline, a benchmark report, or a jurisdiction-specific rule. You can read the original and check the finding yourself.
Are low-confidence findings reviewed by a person?
Yes. Every finding carries a confidence score. High-confidence findings come from deterministic rules and go straight to your queue. Below the threshold, a billing attorney reviews the finding before it reaches you. Attorney review is a quality-control step within the product; it is not legal representation of you.
Is BillingLens HIPAA compliant?
BillingLens implements HIPAA-aligned controls including encryption, access logging and role-based access control, and we will sign a Business Associate Agreement where one is required. We run regular risk assessments and keep documentation of our posture.
How do you handle incident response?
We maintain a documented incident response plan with a 24-hour notification commitment, and automated alerting on the systems that would detect a problem first. Affected customers are notified with details and remediation steps.
Before you send us anything
We will send you our security documentation first.
If your procurement team needs a questionnaire completed, a BAA signed, or a zero-retention agreement in place before you upload a single invoice, ask and we will start there.