Local-first architecture
Documents stay on the device.
Extraction, detection, redaction, validation, OCR, and DICOM handling run locally. PHIPass does not use cloud OCR, cloud NLP inference, analytics upload, or crash upload.
Security
Local processing, explicit controls, and honest boundaries.
PHIPass reduces exposure by processing document content locally. The licensing service receives account and device metadata, not document content or PHI.
License protection
Access is tied to an assigned user and device.
License keys are generated server-side and stored as hashes. Activated devices use cryptographic identities, signed entitlements, protected local storage, and a short-lived session lease.
Operational safeguards
Unverified output is blocked.
The app validates generated outputs and fails closed when a valid license, active session, or required verification result is unavailable.
Your responsibility
Software is one part of compliance.
Organizations still need their own risk analysis, access controls, endpoint security, incident response, policies, and reviewer sign-off.
Compliance posture
PHIPass is not a HIPAA certification.
PHIPass supports local de-identification workflows but does not guarantee that every instance of PHI will be detected or removed. Review the output and your organization's requirements before sharing.