HIPAA
When B3IQ is a business associate, what the BAA covers, which surfaces are out of scope for PHI, and the safeguards behind each claim.
B3IQ can host workloads on protected health information, because the hardware is single-tenant and you own it. That does not happen automatically. This page is the reference version of b3iq.org/hipaa, written for the person filling in a security questionnaire, with the technical detail behind each claim and a link to the page that owns it.
It describes how the service works. It is not legal advice, and it does not decide for you whether HIPAA applies to what you are building.
No government body certifies, endorses, or approves any product or vendor as HIPAA compliant. HHS runs no certification programme and accredits nobody to run one on its behalf. Any "HIPAA certified" badge is self-issued or sold privately. What a vendor can actually offer is a signed BAA, safeguards that are implemented rather than described, and honesty about the gaps.
Is B3IQ a business associate?
If you are a covered entity or a business associate, and a machine you own with us will create, receive, maintain, or transmit ePHI, then B3IQ is your business associate and a BAA is required before that machine handles PHI.
That holds even though we cannot read your workloads. HHS guidance on cloud computing treats a provider of "no-view" services (one that maintains ePHI it has no ability to decrypt) as a business associate. Encryption lowers risk; it does not dissolve the relationship. The conduit exception is narrow, covering mere transmission, and does not reach hosting hardware that holds ePHI at rest.
| Situation | BAA needed? | Why |
|---|---|---|
| Machine hosted by B3IQ, handles PHI | Yes | We maintain hardware holding ePHI. Business-associate relationship, no-view or not. |
| Machine shipped to your own facility | No | Ship-to-you is a checkout option on every build. The machine sits under your physical controls; we do not maintain your ePHI. |
| Machine that never touches PHI | No | A BAA is scoped to the machines you tell us will handle PHI. |
| Machine in earn mode | N/A | Out of B3IQ entirely: rented on an external marketplace. Not a mode a PHI machine belongs in. |
The BAA
Yes. Request it during onboarding or at contact@npclabs.org. The
contracting entity is NPC Labs, Inc., the operator of B3IQ.
It is a negotiated document reviewed by both sides, executed as part of your purchase and before the machine is provisioned, not a checkbox in a settings page. We do not knowingly accept PHI onto hosted hardware without one; if PHI reaches a machine with no BAA in place, tell us and we will treat it as an incident.
Scope
Coverage attaches to your machines and the path to them. It stops where the product deliberately involves other people's hardware.
| Surface | Scope | Detail |
|---|---|---|
| Your hosted machine | In | The server you own in its rack: physical security, power, networking, on-site engineering. |
| Routing to your own machines | In | Every key on your account reaches your machines and nothing else. Ownership is re-resolved server-side per request and a machine id you do not own is dropped, not honoured; with no eligible machine the request 404s rather than falling through. |
| private_transport jobs | In | Request body encrypted to the node transport key; B3IQ relays ciphertext it holds no key for. |
| Usage metadata + receipts | In | Request id, timestamp, model, machine, token counts, latency, status. No prompt or completion text. |
| SSH lane / support grants | In | Per-machine lane you control; support grants are diagnostics-scoped, expiring, revocable. |
| Capacity B3IQ sells on your machine | Out | A machine with spare capacity can have that capacity rented out under your hosting arrangement. Other traffic on your hardware: not access to your data, and not covered by the BAA. |
| Earn mode | Out | Withdraws the machine from every B3IQ path including your own keys, closes SSH, and reboots onto a separate encrypted volume for external GPU marketplaces. |
| Hosted playground | Out | Runs on your own machines, but it is a development tool outside your reviewed application path. |
| Overflow to external providers | Out | Denied on every dispatch path today. If ever enabled for an account, those requests leave our infrastructure under the provider's terms. It will not be enabled under a BAA. |
| GPU marketplace | Out | Not live in production. Multi-tenant by definition when it launches, and outside the BAA. |
| b3iq.org and its analytics | Out | Marketing site, analytics, and the book-a-call form are ordinary web surfaces. |
Earn mode does not lend your machine to B3IQ. It withdraws the machine from every B3IQ inference path, including your own keys, closes its SSH lane, and reboots it onto a separate encrypted volume so it can be rented on external GPU marketplaces. The earn volume cannot read the bare-metal disk. Reclaiming a machine drains renter work before the reboot, so it is not instant. See Operator Security.
There is no public pool a customer key can send into. Routing is own-nodes-strict and a key with no machines is refused. The traffic flows the other way: a claimed, online machine in its dedicated mode is a candidate for inference B3IQ directs to it, which is what an earning machine earns on. Nobody else's data lives on your disk and no other customer can route to your machine, but it is not a single-workload appliance. Raise it before provisioning if your risk analysis needs it to be.
Shared responsibility
You own the machine, so you own more of the stack, and more of the control, than you would on a conventional cloud.
| Area | B3IQ | You |
|---|---|---|
| Applicability | — | Decide whether HIPAA applies; run your own risk analysis; train your workforce. |
| Physical | Facility, rack, power, cooling, networking, 24/7 monitoring and on-site engineering. | Nothing, unless you take ship-to-you, then all of it. |
| Machine OS + data at rest | Platform-layer patching and health on request. | Encryption at rest, OS hardening, user accounts and access on the machine. The key is yours; we do not want a copy. |
| Routing | Route your keys only to hardware you own, enforced per request. | Keep PHI out of the playground, contact forms, and support tickets; keep the machine in its dedicated mode. |
| Content | Keep prompt and completion content out of our datastores. | Choose the models, decide what you send them, and control what your application stores. |
| Downstream | — | Your own BAAs with clients and downstream vendors. |
| Incidents | Report security incidents affecting your ePHI without unreasonable delay. | Your own breach assessment and notification obligations. |
Safeguards
Technical
- Tenancy is physical, and scoping is server-side. Every key on your account routes only to your machines. Ownership is re-resolved from the database on each request rather than trusted from the wire, a scope naming a machine you do not own has that id dropped, and a request with no eligible machine 404s instead of falling through to anything shared.
- Private jobs are encrypted to the node. X25519 key exchange to the node transport key with AEAD encryption. Streaming frames bind a sequence number and a final-frame flag into their authenticated data, so truncated, reordered, dropped, or replayed frames are detected. Extra request fields are rejected before dispatch, so plaintext cannot be smuggled alongside the ciphertext.
- Credentials are stored hashed. API keys, personal access tokens, and local keys are shown once and stored only as hashes. See Operator Security for the full credential taxonomy.
- Audit logs carry no raw identifiers. IP and user-agent appear as hashes, with the IP under a keyed HMAC.
- Remote access is yours to close. The per-machine SSH lane can be disabled from the dashboard and then refuses inbound SSH even where your fleet key is trusted elsewhere. Support grants are diagnostics-scoped, expiring, revocable, and are not authorised to reach raw prompt or output content.
Physical
Your hardware is a specific serial number in a specific rack in Eugene, Oregon: N+1 power, 24/7 on-site engineering, physical security, and machine insurance at replacement value under Managed Hosting. You can name the facility in a data-flow diagram and visit it in person. The facility operator maintains its own physical-security and availability attestations, which we can provide during a security review.
Administrative
- Per-request metadata is retained for 90 days, then deleted automatically. Aggregate counters derived from it identify no individual request.
- Stored
private_transportciphertext is purged after roughly 30 days; a billing skeleton remains. - We do not train on prompts or completions, do not sell them, and no human reviews them.
Evidence
Completed work commits to a signed receipt carrying model identity, machine identity, and token count: content hashes and counts, never the prompt or the output. It is an audit artefact you can hand a reviewer without exposing anything the reviewer should not see. See Receipts & Settlement.
What we do not claim
These are the gaps. They are here because a reviewer will find them anyway, and finding them here is better than finding them later.
- No SOC 2 or HITRUST report of our own. The facility holds its own attestations; those are the facility's, not B3IQ's.
- Confidential compute is not enabled. The
verified_confidential_*privacy classes exist in the routing layer and are fail-closed: a request for one matches no machine today rather than silently downgrading to a weaker class. Until the attestation verifier ships, the strongest class on offer isprivate_transportto a machine you own. Details in Privacy Boundary. - Single-tenant hardware, not a single-workload appliance. Nobody else's data lives on your disk and no other customer can route to your machine, but while it is online with spare capacity B3IQ can direct inference to it. There is no per-machine switch for that today; if your risk analysis needs one, raise it before provisioning.
Before you send PHI
Incidents
Under an executed BAA we report security incidents affecting your ePHI without
unreasonable delay and cooperate with your breach assessment. Report anything you
see to contact@npclabs.org. If it concerns a specific machine, include its
dashboard identifier and nothing else. Do not put PHI in the report.