Suki Assistant
Suki · Ambient AI medical scribe
Ayliea's assessment: Medium RiskAyliea recommends: MonitorIn Ayliea's curated list
Verified . Risk classification and recommended policy are Ayliea's subjective assessments — not vendor certifications.
- Data residency
- United States (Google Cloud)
- Zero retention available
- No
- Certifications
- SOC 2 Type II
Why this rating
Signs a BAA, encrypts in transit and at rest, and deletes audio and transcripts after 30 days — but uses de-identified customer data for ML training (not a no-training vendor), and its SOC 2 Type II is vendor-asserted with the report gated behind the trust center. No verifiable HITRUST or ISO 27001.
Considerations before deploying
- Negotiate a no-secondary-use / no-training clause (or confirm the de-identification standard) into the BAA/MSA — the default posture permits de-identified training
- Request the SOC 2 Type II report and the current subprocessor list under NDA; confirm the underlying LLM and whether inference leaves Google Cloud
- Audio and transcript are deleted after 30 days, but the final note persists for the contract term — confirm deletion-on-termination
Sources
- Suki Security & Compliance FAQ (developer.suki.ai)
- Suki Privacy Policy (www.suki.ai)
- Suki Trust Center (trust.suki.ai)
Want this for every tool on your network?
A scoping call starts an expert assessment that maps your full AI surface — sanctioned and shadow — from the log metadata you share.