HIPAA
When B3IQ is a business associate, what the BAA covers, which surfaces are out of scope for PHI, and the safeguards behind each claim.
B3IQ can host workloads on protected health information, because the hardware is single-tenant and you own it. That does not happen automatically. This page is the reference version of b3iq.org/hipaa — written for the person filling in a security questionnaire, with the technical detail behind each claim and a link to the page that owns it.
It describes how the service works. It is not legal advice, and it does not decide for you whether HIPAA applies to what you are building.
No government body certifies, endorses, or approves any product or vendor as HIPAA compliant. HHS runs no certification programme and accredits nobody to run one on its behalf. Any "HIPAA certified" badge is self-issued or sold privately. What a vendor can actually offer is a signed BAA, safeguards that are implemented rather than described, and honesty about the gaps.
Is B3IQ a business associate?
If you are a covered entity or a business associate, and a machine you own with us will create, receive, maintain, or transmit ePHI, then B3IQ is your business associate and a BAA is required before that machine handles PHI.
That holds even though we cannot read your workloads. HHS guidance on cloud computing treats a provider of "no-view" services — one that maintains ePHI it has no ability to decrypt — as a business associate. Encryption lowers risk; it does not dissolve the relationship. The conduit exception is narrow, covering mere transmission, and does not reach hosting hardware that holds ePHI at rest.
| Situation | BAA needed? | Why |
|---|---|---|
| Machine hosted by B3IQ, handles PHI | Yes | We maintain hardware holding ePHI. Business-associate relationship, no-view or not. |
| Machine shipped to your own facility | No | Ship-to-you is a checkout option on every build. The machine sits under your physical controls; we do not maintain your ePHI. |
| Machine that never touches PHI | No | A BAA is scoped to the machines you tell us will handle PHI. |
| Pooled inference on the public network | N/A | Out of scope entirely — see below. Do not send PHI to the pooled path. |
The BAA
We will sign one. Request it during onboarding or at contact@npclabs.org. The
contracting entity is NPC Labs, Inc., the operator of B3IQ.
It is a negotiated document reviewed by both sides, executed as part of your purchase and before the machine is provisioned — not a checkbox in a settings page. We do not knowingly accept PHI onto hosted hardware without one; if PHI reaches a machine with no BAA in place, tell us and we will treat it as an incident.
Scope
Coverage attaches to your machines and the path to them. It stops where the product deliberately involves other people's hardware.
| Surface | Scope | Detail |
|---|---|---|
| Your hosted machine | In | The server you own in its rack: physical security, power, networking, on-site engineering. |
| Private-scoped API key | In | A key scoped so it routes only to hardware you own. Isolation is physical, not a policy toggle. |
| private_transport jobs | In | Request body encrypted to the node transport key; B3IQ relays ciphertext it holds no key for. |
| Usage metadata + receipts | In | Request id, timestamp, model, machine, token counts, latency, status. No prompt or completion text. |
| SSH lane / support grants | In | Per-machine lane you control; support grants are diagnostics-scoped, expiring, revocable. |
| Public pooled inference | Out | Routes to machines other operators run, who can see the content. Nothing is stored — that is not the bar PHI is held to. |
| Earn mode | Out | Earn mode opens a machine to third-party traffic and force-disables dedicated serving and the SSH lane. |
| Hosted playground | Out | Dashboard playground conversations are stored server-side in plaintext so history works. A development tool. |
| Cloud fallback / third-party models | Out | Overflow leaves our infrastructure under the provider's terms. Private-scoped keys do not fall back. |
| Marketplace | Out | Renting from or listing to other operators is multi-tenant by definition. |
| b3iq.org and its analytics | Out | Marketing site, analytics, and the book-a-call form are ordinary web surfaces. |
Switching a machine to earn mode makes it available to traffic from people who are not you. A machine that handles PHI stays in its dedicated mode. See Operator Security for what else earn mode changes.
Shared responsibility
You own the machine, so you own more of the stack — and more of the control — than you would on a conventional cloud.
| Area | B3IQ | You |
|---|---|---|
| Applicability | — | Decide whether HIPAA applies; run your own risk analysis; train your workforce. |
| Physical | Facility, rack, power, cooling, networking, 24/7 monitoring and on-site engineering. | Nothing, unless you take ship-to-you — then all of it. |
| Machine OS + data at rest | Platform-layer patching and health on request. | Encryption at rest, OS hardening, user accounts and access on the machine. The key is yours; we do not want a copy. |
| Routing | Route a private-scoped key only to hardware you own. | Keep PHI off the pooled path, the playground, and earn mode. |
| Content | Keep prompt and completion content out of our datastores. | Choose the models, decide what you send them, and control what your application stores. |
| Downstream | — | Your own BAAs with clients and downstream vendors. |
| Incidents | Report security incidents affecting your ePHI without unreasonable delay. | Your own breach assessment and notification obligations. |
Safeguards
Technical
- Tenancy is physical. A private-scoped key routes only to your machines. No shared GPUs, no co-mingled traffic.
- Private jobs are encrypted to the node. X25519 key exchange to the node transport key with AEAD encryption. Streaming frames bind a sequence number and a final-frame flag into their authenticated data, so truncated, reordered, dropped, or replayed frames are detected. Extra request fields are rejected before dispatch, so plaintext cannot be smuggled alongside the ciphertext.
- Credentials are stored hashed. API keys, personal access tokens, and local keys are shown once and stored only as hashes. See Operator Security for the full credential taxonomy.
- Audit logs carry no raw identifiers. IP and user-agent appear as hashes, with the IP under a keyed HMAC.
- Remote access is yours to close. The per-machine SSH lane can be disabled from the dashboard and then refuses inbound SSH even where your fleet key is trusted elsewhere. Support grants are diagnostics-scoped, expiring, revocable, and are not authorised to reach raw prompt or output content.
Physical
Your hardware is a specific serial number in a specific rack in Eugene, Oregon: N+1 power, 24/7 on-site engineering, physical security, and machine insurance at replacement value under Managed Hosting. You can name the facility in a data-flow diagram and visit it in person. The facility operator maintains its own physical-security and availability attestations, which we can provide during a security review.
Administrative
- Per-request metadata is retained for 90 days, then deleted automatically. Aggregate counters derived from it identify no individual request.
- Stored
private_transportciphertext is purged after roughly 30 days; a billing skeleton remains. - We do not train on prompts or completions, do not sell them, and no human reviews them.
Evidence
Completed work commits to a signed receipt carrying model identity, machine identity, and token count — content hashes and counts, never the prompt or the output. It is an audit artefact you can hand a reviewer without exposing anything the reviewer should not see. See Receipts & Settlement.
What we do not claim
These are the gaps. They are here because a reviewer will find them anyway, and finding them here is better than finding them later.
- No SOC 2 or HITRUST report of our own. The facility holds its own attestations; those are the facility's, not B3IQ's.
- Confidential compute is not enabled. The
verified_confidential_*privacy classes exist in the routing layer and are fail-closed — a request for one matches no machine today rather than silently downgrading to a weaker class. Until the attestation verifier ships, the strongest class on offer isprivate_transportto a machine you own. Details in Privacy Boundary. - Whoever operates a machine can see what runs on it. On your own hardware that is you. On the pooled network it is someone else — which is the whole reason PHI does not belong there.
Before you send PHI
Incidents
Under an executed BAA we report security incidents affecting your ePHI without
unreasonable delay and cooperate with your breach assessment. Report anything you
see to contact@npclabs.org. If it concerns a specific machine, include its
dashboard identifier and nothing else — do not put PHI in the report.