Nabla
Nabla · Ambient AI medical scribe
Public sources reviewed . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
Scope of this recommendation
Contracted Nabla clinical documentation workflow with approved region and feedback settings.
Public documentation review only. Current audit reports, certificate scope, executed contracts and customer settings were not independently examined. An omitted assurance claim is not evidence that the vendor lacks it.
- Storage and processing locations
- Trust center states US-client storage in US GCP and other clients in EU GCP; Azure speech-to-text subprocessors operate in US/EU regions.
- Retention and ZDR scope
- Audio is not stored by default; optional feedback may include de-identified data. Notes have a configurable 14-day retention period. This is not whole-product ZDR.
- Vendor-reported audits / certifications
- SOC 2 Type II, ISO 27001
Why this rating
Nabla publishes SOC 2 Type II and ISO 27001 summaries and describes short note retention. Its trust center lists Azure speech-to-text, contradicting the former self-hosted-Whisper claim; downstream processing still needs review.
Considerations before deploying
- Execute the applicable BAA and document recording notice/consent before patient use.
- Obtain current product-scoped assurance, subprocessor/data-flow details and contractual training/secondary-use terms.
- Validate audio, transcript, note and backup retention, deletion and EHR access; require clinician review before finalizing documentation.
- Verify optional feedback, de-identification and model-improvement permissions for your agreement.
Sources
- Nabla Trust Center, retention and subprocessors (trust.nabla.com)
- Nabla HIPAA and retention summary (help.nabla.com)
Need a vendor review for your use case?
A scoping call defines the systems, data flows and vendor evidence to review for your use case.