Tobie is built for the people who have to sign off: IT, security, and procurement. Here's exactly where we stand. No vague badges.
A handful of deliberate choices from the model up that keep your benefits data grounded, isolated, and accountable.
Every answer is drawn only from the documents you approve: never invented. Tobie is built on Anthropic's Claude, so your content is never used to train models, and conversation data carries a short 7-day retention window.
Data is encrypted the moment it moves and the moment it rests. TLS protects every connection in transit; AES-256 protects everything stored at rest.
Each customer's data is separated at the database level using Postgres row-level security. Your data is logically yours alone.
Role-based admin controls who can see and change what. Every answer Tobie gives is logged and reviewable by your team.
Tobie runs on Vercel, Supabase, Anthropic, and Cloudflare. Every provider in our stack is independently SOC 2-certified.
Most vendors show you a badge and stop. We'd rather show you the whole path, because the willingness to be precise is itself the trust signal.
Every provider in our stack is SOC 2-certified, and our own controls are in active build against the Trust Services Criteria.
Our independent Type I examination is underway, with a target completion in Q3. We can share interim documentation with reviewers under NDA.
Following Type I, we move into the observation period for Type II, demonstrating our controls operating consistently over time.
The status above is current and maintained. Ask us where we are today. You'll get a straight answer, in writing.
We can support your HIPAA obligations under a signed Business Associate Agreement. Tell us about your PHI requirements and we'll walk through exactly how Tobie handles them.
A complete, current list of the subprocessors Tobie relies on, what each one does, and the data it handles.
The detailed documentation procurement and security teams need: architecture overview, data-flow diagrams, control mappings, and our subprocessor agreements, shared under NDA.
Start with a Guide Review. In a few weeks, your people get answers, and your team gets its time back.