Technical guides on GDPR, HIPAA, and building AI applications that don't leak personal data.
All articles
According to Anthropic's published documentation, Claude's API comes with a DPA and an EU data residency option — but that's a baseline, not a compliance destination. Here's what the regulation actually requires from your application.
read →According to OpenAI's published documentation, its DPA for API customers includes Standard Contractual Clauses and a set of processor commitments. Here's a framework for reading any provider's DPA — what to look for, what it typically won't cover, and what still needs verifying.
read →A technical and administrative checklist for teams building AI features in healthcare. Covers BAAs, HIPAA technical safeguards, audit controls, minimum necessary, and de-identification standards.
read →OpenAI's data retention, training policies, and logging behavior for API customers. What gets stored, for how long, and what your BAA actually changes — and doesn't.
read →Step-by-step guide for developers building AI applications that handle EU personal data. Covers lawful basis, DPAs, cross-border transfers, data minimization, and architectural patterns.
read →According to Anthropic's published documentation, a BAA is available for the Claude API under certain configurations. What healthcare teams actually need to verify and build before treating that as sufficient for handling PHI.
read →A Business Associate Agreement is a legal requirement — not a technical guarantee. Here's what a BAA does and doesn't cover for AI systems handling PHI, and what you still have to build.
read →The terms AI gateway, LLM proxy, and AI router are used interchangeably — but they describe very different tools. Here's a definitive breakdown.
read →Portkey and Helicone are excellent AI gateways — but neither was built to keep sensitive data out of LLM providers. Here's an honest comparison.
read →GDPR's rules on cross-border transfers require appropriate safeguards for data leaving the EU. Here's how to design OpenAI integrations around that requirement, without relying on contracts alone.
read →According to OpenAI's published documentation, a BAA is available for certain enterprise plans — but a BAA alone doesn't make your app HIPAA compliant. Here's what developers building with the OpenAI API actually need to verify and build.
read →