What PukaMed holds
PukaMed stores the commercial data a sales organization uploads: product masters, price lists and contract pricing, claims and formulary exports, CRM records, and the documents that accompany them. It also stores the questions people ask, the answers they receive, and the audit trail around both.
PukaMed is a business intelligence tool. It is not designed to store or process protected health information, and customers should not upload it. Claims exports should be de-identified before upload; the onboarding process checks for common identifier columns and rejects files that contain them.
Tenant isolation model
Each customer is a tenant. A tenant's data lives in its own database schema with row-level security enforced by the database itself, not only by the application. Every query runs inside a transaction that is bound to one tenant, and a query that names no tenant returns nothing.
Uploaded files are stored in tenant-scoped object storage prefixes with separate encryption keys per tenant. Model requests are built from one tenant's records at a time. There is no shared index, no cross-tenant search, and no pooled dataset.
Encryption
Data in transit is protected with TLS 1.2 or higher on every connection, including connections between PukaMed services. Data at rest, including database storage, object storage, and backups, is encrypted with AES-256 using keys managed in the cloud provider's key management service. Keys are rotated on the provider's schedule and can be rotated on request.
Authentication and SSO
PukaMed supports single sign-on over SAML 2.0 and OpenID Connect, so accounts are provisioned and removed through the customer's identity provider. Multi-factor authentication is required on every account that does not sign in through SSO. Sessions expire after a period of inactivity that the customer can shorten, and an administrator can end any session.
Roles and field-level permissions
Access is granted by role. The default roles are rep, manager, finance, and administrator, and customers can define their own. A role controls which datasets a person can ask about and which fields the answer may include.
Field-level permissions are the important part. Cost, margin, and rebate fields are marked restricted at the column level. When a person without access to a restricted field asks a question that touches it, the answer states that the field is restricted rather than omitting it silently, and the value is never sent to the model on that person's behalf.
Audit logging
Every question, answer, source citation, file upload, permission change, and sign-in is logged with the account, timestamp, and originating IP address. Logs are append-only, retained for the length of the contract plus one year, and available to administrators for export. Customers can forward audit events to their own SIEM.
Data retention and deletion
Retention periods for uploaded files, questions, and answers are set by the customer. When a file is deleted, the records derived from it are deleted with it, and the deletion is recorded in the audit log.
When a contract ends, all customer data is deleted within 30 days of the customer's written request, with backups expiring on their normal schedule of no more than 35 days. Written confirmation of deletion is provided.
How the model is used
The model reads records that the platform retrieves from the customer's database and writes the reply. It does not have open access to the database, cannot run its own queries, and cannot see records the person asking is not permitted to see.
Customer data is not used to train models. Not PukaMed's models, and not our model provider's. Our agreement with the provider prohibits training on prompts and outputs and limits retention to what is needed to serve the request.
Subprocessors
PukaMed uses the following subprocessors. Customers are notified before a subprocessor is added.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting, database, object storage, backups | United States |
| Cloudflare | Network edge and DNS, cookieless analytics for this website, delivery of demo-request email | Global edge; United States |
| Anthropic | Model inference. Prompts and outputs are not used for training. | United States |
Where data is hosted
Customer data is hosted in the United States on Amazon Web Services. Backups stay in the same region. Other regions can be discussed for customers with a data residency requirement.
Incident response
Security events are triaged by an on-call engineer. Confirmed incidents that affect a customer's data are reported to that customer's designated contact within 72 hours of confirmation, with a written summary of what happened, what was affected, and what changed as a result. Security concerns can be sent to security@pukamed.ai.
Customer responsibilities
Customers are responsible for confirming they hold the rights to any third-party licensed data they upload, including pricing compendia, claims data, and formulary files, and for keeping those uploads within the terms of their licenses.
Customers also manage their own roles and permissions, and are responsible for keeping protected health information out of the platform.
Certification status
Formal certification is in progress. Until it is complete, PukaMed does not claim any certification or attestation, and we will not send you a report we do not have. We will share our current controls documentation and answer a security questionnaire on request.