> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bowerlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Bower completes its SOC 2 Type I and HIPAA Type I audits

> Independent auditor Advantage Partners issued Bower's SOC 2 Type I report and HIPAA Type I attestation, both with an unqualified opinion and no exceptions. SOC 2 Type II is underway.

**Issued 2026-10-12 · Trust & compliance**

The work you put into Bower is often the most valuable thing your lab owns:
unpublished results, protocols refined over years, and in some workspaces
patient data. Your security team shouldn't have to take our word for how
that work is protected, and now they don't need to.

## What's new

* **SOC 2 Type I report.** [Advantage Partners](https://advantage-partners.com)
  examined the controls protecting the Bower platform against the AICPA's
  Trust Services Criteria for security and found them suitably designed as of
  August 21, 2026. Unqualified opinion, no exceptions noted.
* **HIPAA Type I attestation.** The same auditor examined Bower's health
  information security program against the HIPAA Security Rule and the HITECH
  Act: administrative, physical, and technical safeguards, organizational
  requirements, and breach notification. Unqualified opinion, no exceptions
  noted.
* **The Trust Center is updated.** Both badges now show their issued status,
  and a new [SOC 2 and HIPAA reports](/trust-center/soc-2-and-hipaa) page sets
  out what each report covers and what it doesn't.

## What it means for you

* **Vendor security reviews get shorter.** Send your security or procurement
  team the reports instead of a long questionnaire. Email
  [privacy@bowerlabs.ai](mailto:privacy@bowerlabs.ai) and we will share them
  under NDA.
* **PHI workspaces work as before.** If you hold protected health information,
  you still need a signed BAA with us and
  [Restricted mode](/trust-center/hipaa-compliance) on that workspace. The
  attestation covers Bower's HIPAA safeguards as an organization; it doesn't
  replace either step.

## What's next

A Type I report checks that controls are designed correctly on one date. Our
**SOC 2 Type II** audit, which tests how those controls operate over months, is
underway and will replace the Type I report. We plan to renew both every year.

## Related

* [SOC 2 and HIPAA reports](/trust-center/soc-2-and-hipaa)
* [Trust Center](/trust-center)
* [Restricted mode (HIPAA-ready)](/trust-center/hipaa-compliance)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.