generated: '2026-09-19'
method: searched
probe: true
url: https://philongevity.com/trust
title: Trust & Data Stewardship
last_updated: '2026-08-20'
certifications: []
compliance_claims:
- claim: HIPAA-eligible storage under a signed Google Cloud HIPAA Business Associate Agreement (Firestore, Cloud Healthcare API FHIR store, Cloud Storage); analysis on US-pinned Vertex AI under the same agreement
  source: https://philongevity.com/trust
- claim: HIPAA Alignment Statement — administrative, physical and technical safeguards consistent with the HIPAA Security Rule; not a covered entity
  source: https://philongevity.com/privacy
- claim: Encryption in transit TLS 1.2+, at rest AES-256; role-based access; audit logs of administrative data access
  source: https://philongevity.com/privacy
- claim: Health data not used to train AI models; not sold; aggregate-only telemetry (counts, booleans, timings — no values, filenames or identifiers)
  source: https://philongevity.com/trust
- claim: Account deletion is a single authoritative purge across Firestore, the FHIR store, Cloud Storage, exports and the auth record; full data export on request
  source: https://philongevity.com/trust
- claim: Agent surfaces (MCP, A2A) accept synthetic or de-identified inputs only; PHI never transits them — "the boundary is architectural, not procedural"; agent identity verifiable via ES256-signed card and /.well-known/jwks.json
  source: https://philongevity.com/trust
inherited_not_own:
- Google Cloud SOC 2 Type II and ISO 27001 are cited on /privacy — these are the infrastructure provider's certifications, not an audit of Phi Longevity, so certifications[] above is empty.
contact: support@philongevity.com
evidence:
- {source: 'https://philongevity.com/trust', http_status: 200, keywords: [HIPAA, Business Associate Agreement, encryption, deletion, export, telemetry, agent identity]}
- {source: 'https://philongevity.com/privacy', http_status: 200, keywords: [HIPAA Alignment Statement, AES-256, TLS 1.2, SOC 2 Type II (Google Cloud), ISO 27001 (Google Cloud)]}
note: probe-security-programs.py recorded trust=none for this host because /trust did not clear its keyword bar; the page is nonetheless a dedicated, dated trust page carrying a HIPAA BAA posture statement, so it is recorded here by hand with the certifications list left honestly empty.