// Trust & Security Report
Magical
by HeyAutofill, Inc. (dba Magical)
Two distinct product lines under one brand: (1) the original Magical browser extension for text expansion / autofill for individuals and teams, and (2) 'Magical Agentic AI' - a newer enterprise platform of specialized AI agents for healthcare operations (prior authorization, benefits verification, referrals, payment posting, revenue integrity, records requests) targeted at healthcare providers and payers.
Certifications held
3
Maturity
Growth
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.getmagical.com“An unqualified opinion on a SOC 2 Type II audit report demonstrates to HeyAutofill (dba Magical)’s current and future customers that they manage their data with the highest standard of security and compliance.”
Verify on trust.getmagical.com“Prescient Assurance is a registered public accounting in the US and Canada and provides risk management and assurance services which includes but is not limited to SOC 2, PCI, ISO, NIST, GDPR, CCPA, HIPAA, and CSA STAR.”
Verify on getmagical.com“STRY-LEADING AUTOMATION COVERAGE 80%+ INDUSTRY-LEADING AUTOMATION ACCURACY 90%+ HIPAA compliant Your patients’ PHI stays protected. SOC 2 Type II compliant Your data stays secure with us. Get a copy of the”
> Show 6 unconfirmed / not-held certifications
source: getmagical.comNo public evidence. Neither trust.getmagical.com nor getmagical.com/trust lists ISO 27001. Search results for 'Magic achieves SOC 2, ISO 27001, and HIPAA' refer to a different company, Magic Labs (magic.link, a Wallet-as-a-Service provider); the ISO 27001 certification belongs to Magic Labs, not to this vendor.
source: getmagical.comNo public evidence. The vendor's own DPA/ToS explicitly forbid customers from processing credit card information through the service, indicating cardholder data is out of scope by design rather than PCI-certified.
source: trust.getmagical.comNo public evidence of a CSA STAR listing or self-assessment on the vendor's trust center or site.
source: trust.getmagical.comNo public evidence of FedRAMP authorization; not mentioned anywhere on trust center or marketing pages.
source: getmagical.comNo public evidence of these certifications on the vendor's own domain.
source: getmagical.comNo public evidence of an AI-governance certification (ISO 42001 or equivalent) on the vendor's own domain.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
United States (AWS-hosted); Privacy Policy states data is 'stored on servers in various locations, including the United States' and may be accessed by U.S. government authorities under applicable law. OpenAI is listed as a subprocessor with data location San Francisco, CA.
The Privacy Policy reserves the right to 'develop new applications or other products or services, including to develop, train, optimize and improve artificial intelligence or machine learning algorithms' using collected data, with an opt-out only for a narrow 'Variable Content' feature (email help@getmagical.com). The Trust page instead states 'Our use of large language models prevents any training based on prior runs.' These two vendor-domain statements are not clearly reconciled.
// Security controls
SSO / MFA
Supports single sign-on via SAML 2.0 and requires multi-factor authentication; every action captured in immutable audit logs.
getmagical.comPenetration testing
Annual third-party penetration tests conducted as part of SOC 2 Type II program.
getmagical.comLocal processing (legacy browser extension)
For the original text-expansion/autofill product, keystrokes and template insertion are described as occurring locally in the browser and not leaving the user's computer.
getmagical.comBackups
Agentic AI product: full database backups daily, retained 31 days, point-in-time restore within 14 days. Text Expansion product: general/regional backups daily, retained 7 days.
getmagical.comSubprocessors
trust.getmagical.com// Products & data scope
Data it handles: Form data and text snippets typed/inserted in the browser; vendor states keystrokes and template insertion occur locally on the user's device.
Original product; positioned as a lightweight Chrome-extension automation tool for individuals and small teams.
Data it handles: Operates across browser and desktop applications and a 'data graph' connecting healthcare data points across many backend systems (EHR, payer portals, etc.) for workflows such as prior authorization, benefits verification, referrals, payment posting, and revenue integrity.
Current primary focus per the homepage. Marketed with 'HIPAA compliant' language even though the vendor's own DPA prohibits processing Patient Health Information.
// What to watch
- Public search results for 'Magic + SOC 2 + ISO 27001 + HIPAA' actually describe Magic Labs (magic.link, a Wallet-as-a-Service provider), a completely different company from Magical/getmagical.com/HeyAutofill; Magic Labs' ISO 27001 or A-LIGN attestation does not apply to Magical.
- getmagical.com/trust markets the product as 'HIPAA compliant,' and the current homepage is built around healthcare-provider PHI workflows (prior authorization, claims, revenue cycle), yet the vendor's own Data Processing Addendum (getmagical.com/legal/data-processing) states the Terms 'forbid Customer from processing any data containing ... Patient Health Information.' No BAA offering was found.
- The Privacy Policy reserves rights to use data to 'train, optimize and improve' AI/ML models; the Trust page separately claims LLM usage 'prevents any training based on prior runs.' The two vendor statements are not reconciled.
- Trust center page (trust.getmagical.com) SOC 2 announcement text contains boilerplate language describing the company as a 'cloud-based community management and virtual event platform,' which does not match Magical's actual product; this appears to be an uncorrected template artifact from the compliance-automation vendor rather than a substantive misstatement, but it does mean the SOC 2 report text itself is not company-specific.
- Only part of the subprocessor list is publicly documented (OpenAI confirmed); a full list should be requested from the vendor before enterprise or healthcare procurement.
- No ISO 27001, CSA STAR, FedRAMP, or AI-governance (ISO 42001) certifications found; positioning as an enterprise healthcare vendor exceeds its current formal certification footprint.
// At a glance
Pricing model
Not fully disclosed; consumer/team text-expansion product historically offered free/paid tiers, enterprise Healthcare AI Agents product is sold via 'Book a demo' / custom contract.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on HeyAutofill, Inc. (dba Magical)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-09-30. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.getmagical.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.