Security & data handling

Sutrix runs on established cloud infrastructure: applications on Vercel, data in Supabase (Postgres and object storage), the analysis orchestrator on Railway, and authentication through Clerk. Data is encrypted in transit (TLS) and at rest.

Uploaded datasets are kept in private storage, never public URLs, and are accessed only server-side with scoped credentials. Sutrix does not train models on your data.

We require de-identified data. Direct identifiers do not belong in an upload: names, emails, medical record numbers, and the other HIPAA identifier classes.

We are rolling out an automated screening check for the 18 HIPAA identifier classes at upload. The check is deterministic, plain code. No language model reads your data to perform it.

We retain your dataset and study context while the study is active, so follow-up analyses can run against the same study without re-uploading.

You can request deletion of a dataset, a study, or your account at any time. We remove it, along with derived working copies, within 30 days.

Statistical analyses execute as deterministic code in an isolated sandbox: the same input produces the same output, every time. Each run leaves a full audit trail, and the executed analysis code is preserved as a study artifact. You can see exactly what was run against your data.

Language models are used for planning and narrative drafting, never to compute results.

Sutrix runs on HIPAA-compliant infrastructure: data encrypted in transit and at rest, scoped and logged access, and de-identified data only for analysis. Business associate agreements are available for engagements that require one.

• In progressSOC 2 Type II. An independent auditor reviews our security controls over a period of months.
• In progressHIPAA. An independent review of our controls against the HIPAA Security and Privacy Rules.
• In progressHITRUST. An independent review of our security program against the HITRUST requirements.
• Built for21 CFR Part 11. Analyses run as deterministic code with attributable, time-stamped, reproducible records and a full audit trail, so study artifacts can support Part 11 electronic-record requirements.

Where is our data stored?

In Supabase-managed Postgres and private object storage, encrypted in transit and at rest. Nothing is served from public URLs.

Who can access it?

The study owner through their authenticated account, and Sutrix operators working on the study. Storage is reached only server-side with scoped credentials. There is no public or client-side access path.

Can we delete our data?

Yes. You can request deletion of a dataset or study at any time, and we remove it along with derived working copies within 30 days.

Is the analysis AI-generated?

The numbers are not. Every statistical result comes from deterministic code executed in an isolated sandbox, where the same input produces the same output. That code is preserved as a study artifact you can inspect. Language models help plan the analysis and draft narrative around the results. They never compute your statistics.