Security
Last updated: May 20, 2026. Kluse describes current security posture at a high level without claiming external certification.
1. Security posture
Kluse is designed with healthcare-grade privacy workflows, role-based access, audit logging, compliance gates, and environment separation.
2. Encryption and access
Kluse uses encrypted transport and platform-level storage protections. Access should be limited to authorized users based on workspace role and operational need.
3. Compliance gates
Patient import and outreach are locked until required onboarding steps are complete, including practice profile, legal acceptance, attestation, subprocessors review, and BAA status where applicable.
4. Logging and audit
Sensitive actions such as legal acceptance, uploads, campaign approval, launch attempts, suppression changes, and data requests are logged in an audit trail. Audit metadata should avoid PHI unless legally reviewed.
5. Vendors
Hosting, authentication, payments, communications, AI voice, analytics, and support vendors are listed on the subprocessors page.
6. Limitations
Kluse does not claim SOC 2, ISO 27001, HITRUST, or certified HIPAA compliance unless those certifications are actually obtained and reviewed.