Security, HIPAA and BAA at Chanty

Chanty supports HIPAA compliance with a signed Business Associate Agreement (BAA) on the Business and Enterprise plans. The Free plan has no BAA, so it should not be used for protected health information (PHI). This page lists which security controls exist on which plan, what is not yet publicly documented, and what your practice still has to configure itself.

HIPAA and the BAA: what each plan covers

Business and Enterprise include a signed BAA. On these plans, Chanty supports HIPAA compliance for staff communication. Enterprise also includes a negotiated Master Services Agreement (MSA).

Free has no BAA. Do not share PHI on the Free plan. That includes a patient's name in a message about a rescheduled appointment or a screenshot from the scheduling system. Use Free to try the interface with non-PHI content only.

Sign the BAA before anyone posts PHI. The agreement has to be in place before PHI enters the workspace, not after a pilot has already started.

What the BAA covers. On Business or Enterprise, the signed BAA covers all data in the team space: messages, files, voice notes, tasks and Teambook. Enterprise adds a negotiated MSA, and AI agents need a separate written agreement. For how this works day to day, see HIPAA-compliant chat for staff.

	Free	Business	Enterprise
Signed BAA	Not available	Included	Included
Negotiated MSA	No	No	Included
PHI in messages, files, voice notes	Should not be stored	Permitted under signed BAA	Permitted under signed BAA
Encryption in transit (TLS 1.2+)	Yes	Yes	Yes
Encrypted file storage	Yes	Yes	Yes
Roles and permissions	Not included	Customizable roles	Unlimited custom roles
Two-factor authentication, SSO	Not included	Yes	Yes, plus SAML SSO
Directory sync and SCIM	Not included	Not included	Yes
Customizable retention	Not included	Yes	Yes
IP allowlisting	Not included	Yes	Yes
DLP and governance controls	Not included	Not included	Yes
Data residency (US, EU, APAC) and on-premise	Not included	Not included	Yes
AI agents and agent audit trail	Not included	Not included	Yes

Where Chanty fits: staff coordination alongside clinical systems

Chanty is internal team communication for staff. It covers chats, calls, announcements, files and assigned tasks for operational and administrative work. Typical uses:

• The front desk asks the clinic manager who can cover Saturday check-in at the second location.
• Operations posts an updated supply-ordering procedure and pins it in each site's channel.
• HR announces open enrollment dates.
• IT receives a request about a broken check-in tablet and turns it into a task with an owner and a deadline.

Chanty runs alongside your EHR or EMR, scheduling, billing and patient portal systems. It does not replace any of them. Read more about Chanty for healthcare teams and how it works as healthcare communication software for clinics.

Chanty is not patient messaging, telehealth, clinical documentation, a clinical handoff tool or urgent clinical alerting. Clinical communication and escalation stay in the systems and protocols your organization has approved for them.

A tool with a BAA does not make an organization HIPAA compliant by itself. Compliance depends on your own policies, configuration, training and risk analysis, together with the vendors you choose.

Encryption and infrastructure

• In transit (all plans): TLS 1.2+ with forward secrecy and AES-128-GCM.
• At rest (all plans): file system and file storage encryption. Algorithm and key-management details are not published.
• Hosting: Amazon Web Services (EC2, S3, Elasticsearch). The default AWS region is not published; regional commitments apply on Enterprise only.
• Resilience: synchronous database replication, with snapshots stored in a separate data center.
• Testing: application and infrastructure penetration tests.
• Uptime: 99.9% monthly uptime commitment in the Business plan terms; there is no separate public SLA page.

Chanty is not end-to-end encrypted. Data is encrypted in transit and in file storage as described above.

Access control and identity

Roles and permissions. More than 120 settings define what each person can see and do. Business includes customizable roles, and Enterprise includes unlimited custom roles. For example, a practice can let front desk staff post in site channels without letting them create new channels or invite guests.

Login and identity.

• Business: one-time-code login, two-factor authentication and SSO.
• Enterprise: SAML SSO, directory sync and SCIM provisioning. Accounts can then follow your identity provider, so a departing employee loses access when IT disables them centrally.
• Duo: an integration is available for authentication.

IP allowlisting. Available on Business and Enterprise.

Guest access. External guests, such as contractors, vendors or a billing service, are limited to the conversations you select. They stay separate from internal staff channels. Business includes 3 free guest seats per paid member. See roles, permissions and guest access.

Data handling: retention, residency and model training

Retention. Business and Enterprise include customizable retention settings. Admins can set a workspace-wide period (for example 30, 90 or 365 days, or unlimited), and users and admins can set conversation-level retention from 1 minute up to 90 days, or unlimited. Retention applies to messages, files, voice notes, tasks and Teambook.

Message history. Message history is unlimited and searchable on all plans. On Business and Enterprise, retention settings limit how long that content is kept.

DLP and governance. Data loss prevention and governance controls are included on Enterprise.

Data residency. US, EU or APAC data residency and an on-premise option are available on Enterprise only. Other plans carry no regional commitment.

Model training. Conversations are not used to train outside AI models. What happens in Chanty stays in Chanty.

AI agents and governance (Enterprise)

AI agents in conversations are available only on the Enterprise plan. Free and Business do not include them.

On Enterprise, staff mention an agent in a thread the same way they mention a teammate. The agent reads the context, does the job and reports back in the same conversation. Controls include:

• Interaction levels per role: set who each agent takes orders from.
• Visibility and revocation: agents can be seen and revoked.
• Audit trail: a real-time record of every agent action.
• Same permissions as people: the permission settings that apply to staff apply to agents.

BAA coverage of agent processing and connected third-party models is not publicly documented. AI agents fall outside the standard BAA, so put a separate written agreement with Chanty in place, covering the agents and the models you connect, before any agent is allowed to access channels or files that contain PHI.

Certifications and audits

• SOC 2 Type II, covering the Chanty services; report available on request
• ISO/IEC 27001:2022, covering the Chanty services; report available on request
• ISO 9001
• GDPR compliance, with processes and tools for GDPR compliance
• EU-U.S. Data Privacy Framework participation

HIPAA and GDPR have no official certification, and no vendor can be "HIPAA certified." Chanty is HIPAA-compliant with a signed BAA from the Business plan.

SOC 2 Type II and ISO/IEC 27001 reports are available from Chanty on request; raise any security questionnaire with Chanty as part of your evaluation.

Shared responsibility: what your practice configures

Chanty provides the controls. Your practice decides how they are used.

• BAA: sign it before handling PHI, and keep PHI off the Free plan.
• Roles, permissions and retention: configure them to match who needs to see what. Billing staff, for instance, may not need access to HR channels.
• User access and offboarding: remove accounts the day someone leaves, or connect SCIM on Enterprise.
• Device security: set requirements for phones and computers staff use, including personal devices.
• AI agents (Enterprise): choose which models and agents to connect and what they may access.
• Integrations: third-party integrations such as Google Drive, Dropbox, Zapier, Make or n8n are outside Chanty's BAA. Each needs its own review, and its own BAA wherever PHI could pass through it. You can check whether other tools you use are HIPAA compliant.
• Staff policies and training: define what may and may not be shared in chat, and train staff on it. Start with our free HIPAA templates and checklists.

Next steps for evaluators

1. Choose Business or Enterprise based on the controls you need.
2. Request and sign the BAA before any PHI is shared.
3. Set up roles, permissions and retention.
4. Turn on two-factor authentication and SSO (SAML SSO and SCIM on Enterprise).
5. Review every integration you plan to connect and remove any that would touch PHI without a BAA.
6. Publish a short staff policy on what belongs in chat.

For day-to-day HIPAA use, see the HIPAA-compliant chat page linked above. To weigh alternatives, compare BAA scope across Slack, Teams, Google Chat and WhatsApp.

Start at chanty.com/signup. Ask about Enterprise if you need SAML SSO, SCIM, data residency, on-premise deployment or AI agents.

FAQ

Is Chanty HIPAA compliant?

Chanty supports HIPAA compliance with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA.

Does Chanty sign a BAA on the Free plan?

No. A BAA is available from the Business plan.

Is Chanty end-to-end encrypted?

No. Data is encrypted in transit with TLS 1.2+, and file storage is encrypted.

Can we use Chanty to message patients?

No. Chanty is for internal staff communication only.

Does the BAA cover integrations like Google Drive or Zapier?

No. Third-party integrations are outside Chanty's BAA scope. Review each one separately.

Are AI agents covered by the BAA?

BAA coverage of agent processing and external models is not publicly documented. Confirm scope with Chanty before allowing agents to access PHI. AI agents are available on Enterprise only.

Is our data used to train AI models?

No. Conversations are not used to train outside models.

Where is our data stored?

On Amazon Web Services. US, EU or APAC data residency and an on-premise option are available on Enterprise. Other plans carry no regional commitment.