Pricing
Priced by isolation, not by feature gate.
Every plan includes the whole product and every security control. What changes between them is how your data is physically separated from everyone else's — which is the part that actually costs money to provide.
Practice
Solo providers and small clinics
Pricing on a short call
shared_rls
- The full product surface, every domain
- Row-level security isolation, a shared customer-managed KMS key
- Your own practice URL and branded sign-in
- Audit explorer and posture scoring
- Email support
Practice Plus
Practices with strict separation or blast-radius requirements (every tier is US-hosted)
Pricing on a short call
dedicated_db
- Everything in Practice
- Your own database, RLS still enforced
- Independent migration windows
- Tenant-scoped backup and restore
- Region pinning and custom retention
Dedicated
High-assurance and contractual-isolation tenants
Pricing on a short call
dedicated_env
- Everything in Practice Plus
- Your own stack: database, object store, and KMS key
- Its own API deployment, in the network yours provides — no per-tenant network is built
- Named security contact and review cadence
- SIEM forwarding of security findings
Pricing is quoted per practice after a short scoping call — we would rather know your headcount, your isolation requirement, and your migration situation than publish a number that is wrong for you.
In every plan
Security is not a tier.
Charging more for the audit trail would mean selling a version of this product that cannot prove what it did. There is no such version.
- Deny-by-default authorization
- Tamper-evident audit chain
- MFA and step-up re-authentication
- Minimum-necessary data scoping
- AI governance and autonomy controls
- Audited break-glass access
Questions we get asked
Before the call.
- Do you charge per seat?
- Per practice, with a headcount band. A front-desk login should not be a reason to share a password.
- What happens to our data if we leave?
- Today: each patient’s portal record as a FHIR file, FHIR Bulk Data export by patient or group through an approved app, and the record integrity report, which you generate and download from the security console. A whole-practice export with the audit trail for your tenure is not self-serve yet — today it is a supported engagement with us rather than a button.
- Do you handle insurance, or only cash pay?
- Both, on the same coded ledger, decided per encounter. Charges carry CPT, HCPCS, and ICD-10 whether or not a payer sees them, so moving between models is a setting rather than a migration. Payer-edge connectors — eligibility, clearinghouse submission, remittance posting — attach at the boundary; ask us which are live for your payers.
- Do you charge per claim or per transaction?
- No. Pricing is per practice by isolation tier. A practice that bills more should not pay us more for the privilege of using its own ledger.
- What reaches an AI model, and under what terms?
- Only what the task needs, and only to a provider under a BAA and approved for PHI. Every call is risk-tiered and recorded.
- Is there a free trial?
- A guided demo on synthetic data, then a scoped pilot. We do not hand out unsupervised PHI environments.
