HIPAA and Eddie

The short version

• HIPAA: self-assessed. There is no official HIPAA certification, and we do not claim one. We assessed our own safeguards against the HIPAA rules.
• A BAA is available for enterprise customers. If you are a covered entity or business associate, sign a Business Associate Agreement with us before any protected health information (PHI) reaches Eddie.
• SOC 2 Type II audited. An independent auditor, Advantage Partners, tested our controls against the Security criterion from May to August 2026.

Request a BAA

Email hey@heyeddie.ai with your organization's name and what your footage contains. We put the BAA in place as part of an enterprise agreement.

Do not upload footage with PHI until the BAA is signed. Without one, Eddie is not set up to receive PHI for you.

What data goes where

• Footage you import into Eddie's cloud is stored and processed by Eddie, and by the third-party providers that do some of the work for us (for example transcription and AI models). Each is listed, with what it may do, in our Trust Center.
• On-device Eddie runs locally on your own machine. Ask us whether it fits your requirements.
• We do not train AI models on your content, and we do not authorize the third-party AI providers that process it for us to train on it. See the Terms.
• Everyone in a workspace can open every project in it. Keep PHI in a workspace whose members are allowed to see it. See What everyone in a workspace can see (and spend).
• Deleting data: see Delete a project and Delete your Eddie account and data.

Security documentation, the SOC 2 report (under NDA) and the subprocessor list are in the Trust Center.

Related: Legal, security and compliance, GDPR and Eddie, Contact support.