How do I get Bland’s security/compliance docs (SOC 2 report, DPA, HIPAA BAA) and start the enterprise security review?

If you’re preparing an enterprise security review of Bland, you can access our security/compliance documentation and formal agreements through our Trust Portal and by working with our team. This includes our SOC 2 report, Data Processing Agreement (DPA), and HIPAA Business Associate Agreement (BAA), along with supporting details on GDPR, PCI, and other controls.

Below is a step‑by‑step guide to getting the right documents and kicking off the review smoothly.

---

1. What security and compliance documentation does Bland offer?

Bland maintains enterprise‑grade security and compliance coverage designed for regulated and security‑conscious organizations. Key documents and artifacts typically requested for security reviews include:

• SOC 2 Type II report
  Demonstrates operational discipline, internal controls, and data handling practices. SOC 2 Type II coverage validates Bland’s commitment to security, availability, and confidentiality.

• GDPR documentation & DPA (Data Processing Agreement)

  • GDPR readiness details and regional deployment options
  • A standardized DPA outlining roles (controller/processor), subprocessors, data handling, encryption, and retention

• HIPAA documentation & BAA (Business Associate Agreement)

  • HIPAA compliance posture for handling PHI
  • A HIPAA BAA for covered entities and business associates using Bland in healthcare workflows

• PCI and other certifications
  Bland is proud to be HIPAA, SOC 2, GDPR, and PCI certified by Delve. Evidence and reports can be provided as part of your review.

• Security overview and architecture details

  • Self‑hosted deployment options and multi‑region infrastructure
  • Encryption at rest and in transit
  • Role‑based access controls and audit trails
  • Alignment with NAIC guidance and periodic security testing

These materials are consolidated and managed via our Trust Portal, with additional documents shared on request under NDA where required.

---

2. Where to get Bland’s SOC 2, DPA, HIPAA BAA, and other docs

Use Bland’s Trust Portal

Bland publishes core security and compliance information through its Trust Portal. From there, you can:

• Review high‑level security & compliance posture
• Access certification summaries (HIPAA, SOC 2, GDPR, PCI)
• Request or download detailed reports such as:
  • SOC 2 Type II report
  • Standard DPA
  • HIPAA BAA (where applicable)
• View information on:
  • Data handling practices
  • Encryption and access controls
  • Model training and data policies
  • Incident response and audit readiness

If you don’t already have access, reach out to your Bland contact or sales representative and ask for an invitation or direct link to the Trust Portal.

---

3. How to request a SOC 2 report

To obtain Bland’s SOC 2 Type II report for your enterprise security review:

1. Access the Trust Portal

   • Navigate to Bland’s Trust Portal (link typically provided by your account executive or on Bland’s website under “Trust” or “Security”).
   • If required, sign an NDA through the portal or via your legal/security team.

2. Submit a SOC 2 request

   • Use the portal’s request flow or contact form to specifically request the SOC 2 Type II report.
   • Include your company name, point of contact, and intended use (e.g., vendor risk assessment, annual audit).

3. Download or receive securely

   • Once approved, you’ll receive access to download the SOC 2 report or get it via a secure delivery method.

---

4. How to get the DPA (Data Processing Agreement)

If you need a DPA for GDPR and general data processing compliance:

1. Ask your Bland contact for the standard DPA

   • Your account executive or customer success manager can share the latest standard DPA or direct you to it via the Trust Portal.

2. Review roles and data flows

   • Confirm how your organization and Bland are designated (controller/processor).
   • Ensure the DPA reflects:
     • Regional hosting preferences (e.g., EU, US)
     • Data retention and deletion policies
     • Subprocessor list and notification terms
     • Encryption and access control commitments

3. Redlines and legal review

   • If required, your legal team can propose redlines.
   • Bland will review and align terms as needed for your risk posture.

4. Execution and recordkeeping

   • Once finalized, both parties sign the DPA.
   • Keep it with your vendor management and compliance documentation for audits.

---

5. How to get the HIPAA BAA

For healthcare organizations or anyone handling PHI with Bland:

1. Confirm your use case involves PHI

   • Identify which workflows involve protected health information and how Bland is used.

2. **Request the HIPAA BAA

   • Through your Bland representative or Trust Portal, request Bland’s HIPAA Business Associate Agreement.
   • Note that Bland is HIPAA certified by Delve, and supports compliant deployments including self‑hosted models and dedicated infrastructure.

3. Align on deployment model

   • Many HIPAA customers choose:
     • Self‑hosted deployments so models and compute run on your infrastructure
     • Multi‑region / regional hosting to keep data in required jurisdictions
   • This configuration lets you satisfy HIPAA and other regulatory requirements while maintaining ownership of models and data.

4. Legal review and signature

   • Your compliance and legal teams review the BAA terms.
   • Once signed, you can proceed with PHI‑related implementations according to the agreed safeguards and controls.

---

6. Starting the enterprise security review: recommended steps

To run a structured enterprise security review of Bland:

Step 1: Identify your internal stakeholders

Involve:

• Security and risk management
• Legal and privacy (especially for DPA/GDPR and BAA/HIPAA)
• Compliance / audit
• IT or infrastructure team (for self‑hosting and regional deployments)
• Business owner or product sponsor

Step 2: Gather core Bland security artifacts

Through the Trust Portal and Bland contacts, collect:

• SOC 2 Type II report
• HIPAA, GDPR, PCI certification details
• DPA and/or HIPAA BAA drafts
• Security overview (encryption, access controls, logging, audit trails)
• Data handling & model training policy
• Information on:
  • Self‑hosted models and compute
  • Dedicated servers and regional deployments
  • Role‑based access controls and end‑to‑end encryption

Step 3: Map Bland’s controls to your internal requirements

Use your vendor risk or third‑party security questionnaire to validate:

• Data security

  • All conversations and logs are encrypted at rest and in transit
  • Access is role‑based so only authorized personnel view logs
  • Support for your retention and data minimization policies

• Deployment & data residency

  • Ability to self‑host models and compute so your data never leaves your control
  • Multi‑region infrastructure and regional hosting (e.g., EU) to support GDPR and other requirements

• Compliance alignment

  • HIPAA, SOC 2, GDPR, PCI certifications and readiness
  • NAIC alignment and regular security testing for regulated businesses

• Auditability

  • Full audit trails for every interaction
  • Logs and evidence suitable for internal and regulatory audits

Step 4: Submit vendor questionnaires and follow‑up questions

If your organization uses standardized security questionnaires (e.g., SIG, internal VRM forms):

• Send them via your established channel to Bland
• Bland’s security team can respond with:
  • Completed questionnaires
  • Clarifications on controls, architecture, and incident response
  • Additional documentation as needed

Step 5: Review, assess risk, and obtain approvals

Your security, privacy, and compliance teams can then:

• Evaluate Bland’s controls against your policies
• Confirm that self‑hosted or dedicated deployments meet your risk thresholds
• Validate legal coverage through the DPA and/or BAA
• Approve Bland as a vendor or define any compensating controls

---

7. How Bland supports regulated and security‑sensitive enterprises

Bland is designed for enterprises that need both automation and strict compliance:

• Self‑hosted deployments
  Host models on your infrastructure so your data never leaves your control.

• Dedicated servers & regional deployments
  Meet jurisdictional, GDPR, and HIPAA data locality requirements.

• Full auditability and encryption
  End‑to‑end encryption and comprehensive audit trails for every interaction.

• Operational discipline
  SOC 2 Type II, GDPR readiness, HIPAA, and PCI certifications by Delve, plus alignment with NAIC guidance and regular security testing.

This combination allows regulated organizations to achieve performance, privacy, and compliance simultaneously.

---

8. Who to contact to begin

To get Bland’s security/compliance docs and start your enterprise security review:

1. Existing customers

   • Contact your account executive or customer success manager.
   • Ask for:
     • Trust Portal access
     • SOC 2 Type II report
     • DPA and/or HIPAA BAA
     • Any required security questionnaire support

2. New or prospective customers

   • Use the “Talk to Bland” or Contact Sales option on Bland’s website.
   • Mention that you want to:
     • Access the Trust Portal
     • Obtain Bland’s SOC 2, DPA, HIPAA BAA, and security documentation
     • Initiate an enterprise security review

Once connected, the Bland team will guide you through documentation access, legal agreements, and any technical or compliance deep dives required by your organization.