Security and trust

Last updated: November 2026

Fold runs care work that involves protected health information. This page sets out how we protect it and who to ask.

SOC 2 Type II

Fold is SOC 2 Type II audited. The report is available to customers under NDA. Request the report or write to security@fold.health.

HIPAA and the BAA

Fold is HIPAA compliant and acts as a business associate of each customer. We sign a business associate agreement (BAA) with every customer, and we use protected health information only as the BAA and HIPAA permit.

Data protection

We use technical, organizational and physical safeguards designed to protect the information we handle. Data is encrypted in transit and at rest. Systems connect with scoped access, and each document read is logged. Before go-live, we review access, authentication, tenant boundaries, hosting and data flows with your security team.

AI agents and PHI

AI agents work within the rules and permissions your team sets. A named person makes every clinical decision. Every step, by an AI agent or a person, is recorded in one audit trail.

This website

fold.health never asks for protected health information. Please do not include patient information in any form on this site.

Contact

Security questions, reviews and reports: security@fold.health. For a security review as part of an evaluation, contact us.