Security

This page expands the security claims on the front page. If your organization has a security questionnaire, vendor review, or IT committee, send it to jonathan@phoenixrisingai.com — we answer them directly, in writing.

What Johna never touches

• Credentials. No VA.gov logins, passwords, ID.me details, or verification codes — ever. Johna is instructed to interrupt a veteran who starts reading one out, and this behavior is part of every session review. She guides; the veteran types.
• Filings. Johna never submits a claim, never logs into a VA system, and never acts on a veteran’s behalf. Drafts go to the accredited VSO representative holding the 21-22.

Encryption and data handling

• Calls, texts, and photos are processed on platforms built for HIPAA environments, encrypted in transit (TLS) and at rest.
• A DD-214 or decision letter texted to Johna is handled with the same controls a medical record would receive.
• Johna retains what she needs to brief the VSO and remember the veteran between calls — and no more. The memory system (patent pending) is designed to work from less data, not more.
• Veteran data belongs to the veteran and the VSO that represents them. We do not sell it, share it with third parties for their own use, or use it to train foundation models.

Business Associate Agreements

We sign a BAA with every VSO partner before the first veteran call. Our infrastructure vendors — telephony, transcription, model, and storage providers — are selected for HIPAA-eligible service tiers, and we maintain agreements with them consistent with our obligations under each partner BAA. Ask us for the current vendor list under NDA.

SOC 2-aligned architecture

Phoenix Rising AI is not yet SOC 2 certified; we say “architected to SOC 2 standards” deliberately. In practice that means:

• Role-based access control and least-privilege access to production data
• Encryption in transit and at rest across all storage and messaging
• Audit logging of access to veteran records
• Separation of environments; no veteran data in development or test
• Incident response with partner notification commitments in the BAA

When a formal SOC 2 examination is complete, the report will be available to partners under NDA, and this page will say “certified” instead.

Escalation

If a veteran sounds like they are in danger, Johna gives them the Veterans Crisis Line — dial 988, then press 1 — and escalates to the human contact each VSO designates during onboarding. That rule overrides everything else she is doing on the call.

Questions

Security questionnaire, pen-test summary request, data-flow diagram, or anything else: jonathan@phoenixrisingai.com or 863-390-0973.