Security & Compliance
Every inference. Every interaction. Inspectable.
HIPAA-friendly by architecture. On-premise by default. Auditable end to end. Written for your security team, your privacy officer, and your compliance committee.
The Perimeter
Nothing calls out.
The platform is designed to run without any outbound network dependencies. No telemetry, no cloud model calls, no shadow API endpoints. Every prompt, every completion, every tool invocation stays inside your building.
Your network team can put the GofarAI subnet behind a strict egress firewall. Nothing about the platform’s operation requires internet access. Software updates arrive through a signed, offline package process on a schedule you control.
Controls
Standard security primitives, from day one.
Encryption at rest
All persisted data on the GofarAI box is encrypted at rest using standard block-level encryption. Keys stay inside your infrastructure.
Role-based access control
Users and service accounts see only what their role permits. Access maps to your existing directory and IdP where possible.
Full audit logging
Every inference, every completion, every tool call is logged with actor, timestamp, and data scope. Streams into your SIEM.
Sensitive data domains
Department isolation for 42 CFR Part 2.
Behavioral-health data under 42 CFR Part 2 is held to a stricter standard than general HIPAA. Our multi-model architecture supports full department isolation: separate fine-tuned adapters so weights never mix information domains, separate audit trails, separate access rules.
A router model in front classifies each request and directs it to the correct isolated model. Information domains stay separate, all the way down to the adapter file.
Agent-to-agent traffic
The MCP gateway is a control point.
Hospitals are accumulating AI agents from multiple vendors. Without a control point, agent-to-agent traffic becomes an ungovernable back channel. The MCP gateway enforces which agent can call which tool, with what data scope, at what rate — and logs everything.
Your compliance team sees every interaction. Your security team can revoke any agent’s access with one policy change. The gateway becomes the auditable seam between all the AI vendors in your building.
A note on wording
We describe the GofarAI stack as “HIPAA-friendly by architecture.” We don’t call the platform “HIPAA compliant” — compliance is a property of a specific deployment inside a specific hospital, signed off after that hospital’s own audit. What we ship is a stack designed to make your compliance work possible: on-premise inference, no external calls, encryption, audit logging, role-based access, and department isolation. The last-mile compliance work is done together, with your team.
Bring your security team to the call.
We prefer conversations where the CISO, privacy officer, and network team are in the room. It’s faster to answer real questions than to guess at objections.