Abridge
Abridge · Ambient AI medical scribe
Ayliea's assessment: Medium RiskAyliea recommends: MonitorIn Ayliea's curated list
Verified . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
- Data residency
- United States (primary; policy permits processing where service providers are located)
- Zero retention available
- No
- Certifications
- SOC 2 Type II
Why this rating
Purpose-built for healthcare: signs BAAs and holds a SOC 2 Type II attestation via its trust center. But PHI flows to third-party providers (OpenAI and Google Cloud are on its published subprocessor list), and no primary-source no-training or fixed-retention commitment was found — approve with those confirmed in the BAA.
Considerations before deploying
- Execute a BAA with an explicit no-PHI-training clause and a defined audio/transcript retention period
- Confirm the OpenAI path is a BAA-covered, zero-retention enterprise endpoint (request the subprocessor list + network diagram from the trust center)
- No verifiable HITRUST or ISO 27001 — SOC 2 Type II only
- Patient recording-consent workflow is the customer's responsibility
Sources
- Abridge Trust Center (trust.abridge.com)
- Abridge Privacy Policy (www.abridge.com)
Want this for every tool on your network?
A scoping call starts an expert assessment that maps your full AI surface — sanctioned and shadow — from the log metadata you share.