Docs GitHub Discord Download Open console

Evidence regenerated 2026-10-07Verified from the code on every release

SDK Desktop Self-host Release notes Trust GitHub Discord Talk to Founders

Oya Browser Enterprise · Trust Center

enterprise.oyabrowser.com sales@getoya.ai

Compliance overview

Current status, verified from the code

H

HIPAABAA available

11 of 11 Security Rule controls verified

H

HIPAA, self-hostedAvailable

Runs entirely in your own cloud

Featured documents

Security and compliance documentation

HIPAA Security Rule evidence packRequest access Business Associate AgreementRequest access Security Risk AssessmentRequest access

Compliance program

The security controls in place

Access Control and Authorization

MFA required for HIPAA projects
MFA required for administrative access
Role-based access per project
Automatic logoff
API keys stored as hashes
Staff access to customer accounts audited

Data Protection

Data encrypted at rest
Data encrypted in transit
No screen recordings in HIPAA mode
Deletion on request

Audit Logging and Monitoring

Tamper-evident audit trail
Audit log is append-only
Audit records kept six years
Recording access and refusals audited
Error reports scrubbed

Infrastructure and Network Security

Dedicated cluster for enterprise workloads
Browsers isolated per session
Network policy enforced
Egress through an allow-list proxy
Images pinned by digest
Database on a private network

Vendor Management

BAAs with every subprocessor on the ePHI path
Models restricted to BAA-covered hosts
No outside CAPTCHA solvers or browser vendors

Disaster Recovery

Automated backups
Point-in-time recovery
High-availability database

Questions or a security questionnaire: sales@getoya.ai. Found a vulnerability? Report it privately.