Skip to main content
Issued 2026-10-12 · Trust & compliance The work you put into Bower is often the most valuable thing your lab owns: unpublished results, protocols refined over years, and in some workspaces patient data. Your security team shouldn’t have to take our word for how that work is protected, and now they don’t need to.

​
What’s new

  • SOC 2 Type I report. Advantage Partners examined the controls protecting the Bower platform against the AICPA’s Trust Services Criteria for security and found them suitably designed as of August 21, 2026. Unqualified opinion, no exceptions noted.
  • HIPAA Type I attestation. The same auditor examined Bower’s health information security program against the HIPAA Security Rule and the HITECH Act: administrative, physical, and technical safeguards, organizational requirements, and breach notification. Unqualified opinion, no exceptions noted.
  • The Trust Center is updated. Both badges now show their issued status, and a new SOC 2 and HIPAA reports page sets out what each report covers and what it doesn’t.

​
What it means for you

  • Vendor security reviews get shorter. Send your security or procurement team the reports instead of a long questionnaire. Email [email protected] and we will share them under NDA.
  • PHI workspaces work as before. If you hold protected health information, you still need a signed BAA with us and Restricted mode on that workspace. The attestation covers Bower’s HIPAA safeguards as an organization; it doesn’t replace either step.

​
What’s next

A Type I report checks that controls are designed correctly on one date. Our SOC 2 Type II audit, which tests how those controls operate over months, is underway and will replace the Type I report. We plan to renew both every year.