// Trust & Security Report
Viz.ai
Viz.ai One, an AI-powered care coordination platform delivering over 50 FDA-cleared algorithms across therapeutic suites (Neuro/stroke, Cardio, Vascular, Pulmonary, Trauma, Radiology) for hospital and health-system providers, plus a separate Viz Life Sciences line built with pharma and medical device partners for clinical trial enrollment and patient access programs.
Certifications held
10
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on viz.ai“SOC 2 Type II: Independent audit demonstrating the effectiveness of controls across security, availability, confidentiality, processing integrity, and privacy over a defined audit period.”
Verify on viz.ai“We have received internationally recognised security certifications to meet the ISO 27001 (information security management system) standard.”
Verify on viz.ai“ISO27701 Security techniques, extension to ISO27001 for Privacy Information Management”
Verify on viz.ai“ai Achieves ISO/IEC 42001 Certification, Setting the Standard for Agentic AI in Healthcare”
Verify on viz.ai“ISO 27017 / 27018: Cloud security and data protection standards governing our cloud-hosted infrastructure.”
Verify on viz.ai“ISO 27799: Healthcare-specific security controls tailored for clinical environments and PHI.”
Verify on viz.ai“ISO 22301: Business continuity and resilience to ensure uninterrupted clinical workflows.”
Verify on viz.ai“report scope covers Viz.ai production systems and supporting infrastructure. HIPAA: Viz.ai operates a comprehensive HIPAA compliance program, including administrative, technical, and physical safeguards”
Verify on viz.ai“This operational approach ensures GDPR compliance is embedded into how our platform is designed, deployed, and maintained—not treated as a one-time certification exercise.”
Verify on viz.ai“ISO 27017 / 27018: Cloud security and data protection standards governing our cloud-hosted infrastructure.”
> Show 3 unconfirmed / not-held certifications
source: viz.aiNo public evidence. Viz.ai is a B2B/B2H healthcare software provider contracted directly with hospital systems; no cardholder-data-handling payment flow is described on the trust center, privacy policy, or press releases.
source: viz.aiNo public evidence. Not listed on the trust center page or in any press release found; Viz.ai's public materials do not reference a federal government authorization.
source: viz.aiNo public evidence. Not mentioned on the trust center page, privacy policy, or press releases.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
US (Viz.ai Inc., San Francisco, CA) with distinct regional entities and privacy policies for EU (Viz.ai Netherlands B.V., Heerenveen) and UK (Viz.ai Ltd., St. Albans); cross-border transfers use adequacy decisions or EU Model Clauses per the Trust Center Privacy Notice.
Viz.ai's core products are FDA-cleared clinical decision-support algorithms, not a generative or LLM chat product, and the company publicly states it uses separated training/validation/test datasets during algorithm development. However, no vendor-domain page explicitly documents whether a given hospital customer's imaging or EHR data is used to retrain production algorithms, or whether an opt-out exists. Protected Health Information use is instead governed by a separate HIPAA Business Associate Agreement that is not published publicly.
// Security controls
Independent security audits
Annual SOC 2 Type II audit (4 consecutive years as of Feb 2024) performed by an independent Big Four audit firm, covering security, availability, processing integrity, confidentiality, and privacy trust service principles.
viz.aiAI governance program
ISO/IEC 42001 (AI Management System) certification covering governance structure, risk/impact assessments, data governance, algorithm performance monitoring, and AI oversight integrated into engineering and quality processes across the full AI lifecycle.
viz.aiPHI safeguards
Comprehensive HIPAA compliance program with administrative, technical, and physical safeguards; PHI use governed by a HIPAA Business Associate Agreement between the customer and Viz.ai.
viz.aiISMS oversight
Information security management system and associated certifications are owned by Viz.ai's management team, with day-to-day responsibility resting with a dedicated Chief Information Security Officer (CISO).
viz.aiTrust portal / evidence sharing
A dedicated, gated trust center portal (powered by Drata) at trustcenter.viz.ai lets prospective customers request the SOC 2 Type II report, HIPAA documentation, and subprocessor list under NDA.
trustcenter.viz.ai// Products & data scope
Data it handles: Protected Health Information (PHI): medical imaging (CT, EKG, echocardiograms), EHR data, real-time clinical communications
Core hospital/health-system product; 50+ FDA-cleared algorithms across Neuro, Cardio, Vascular, Pulmonary, Trauma and Radiology suites. This is the platform explicitly named in the SOC 2 Type II + HIPAA audit.
Data it handles: Aggregated and/or de-identified clinical data used to support patient recruitment, adherence, and clinical trial enrollment for pharmaceutical and medical device partners
Separate go-to-market and data-use pattern from the direct-to-provider platform; no separate certification scope was found distinguishing this product line from Viz.ai One.
// What to watch
- Certification claims were verified via the public trust center marketing page, two independent Viz.ai press releases (SOC 2/HIPAA, ISO 42001), and the privacy policy, all on the vendor's own domain.
- No vendor-domain statement explicitly addresses whether hospital or customer clinical data is used to retrain production AI algorithms, or whether an opt-out exists; PHI handling is deferred to a non-public HIPAA BAA.
- GDPR is a compliance posture (internal policies, audits, EU Model Clauses, ISO 27701 'supporting GDPR'), not an independent third-party certification or seal; there is no formal GDPR certification to hold.
- Three separate regional privacy policies (US, EU platform users, EU non-platform users) plus a distinct Trust Center Privacy Notice exist; a buyer should confirm which policy governs their specific relationship.
// At a glance
Pricing model
Enterprise/health-system contract, no public self-serve pricing
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Viz.ai, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
viz.ai// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.