Skip to main content
Bower has completed two independent audits: a SOC 2 Type I examination and a HIPAA Type I attestation. Both were performed by Advantage Partners, an independent audit firm, under AICPA attestation standards. Both reports carry an unqualified opinion with no exceptions noted, and both were issued on October 12, 2026. You trust Bower with unpublished results, protocols your lab spent years refining, and in some workspaces patient data. These reports are an outside check on the controls that protect that work, by someone other than us.

​
At a glance

​
Is Bower SOC 2 compliant?

Bower has a SOC 2 Type I report with an unqualified opinion and no exceptions noted. An independent auditor examined the controls that protect the Bower platform and found them suitably designed, as of August 21, 2026, to meet the AICPA’s Trust Services Criteria for security. “SOC 2 compliant” isn’t a formal status; a SOC 2 report is an auditor’s opinion, and this is what ours says. Our SOC 2 Type II audit is underway. Type II tests whether those same controls operated effectively over a period of months, not only whether they were designed correctly on one date. We will publish it here when the report is issued.

​
Is Bower HIPAA compliant?

Bower has an independent HIPAA Type I attestation. Advantage Partners examined Bower’s health information security program against the HIPAA Security Rule and the HITECH Act and issued an unqualified opinion with no exceptions noted, as of August 21, 2026. There is no government certification for HIPAA, so an independent attestation like this one is how a vendor shows its safeguards have been checked by someone other than itself. Bower acts as a Business Associate, not a Covered Entity. If you will place protected health information (PHI) in Bower, you still need a signed Business Associate Agreement (BAA) with us, and the workspace that holds PHI should run in Restricted mode, which is how the PHI controls are enforced.

​
What Type I means, and what it doesn’t

A Type I report answers one question: on a specific date, were the right controls in place and designed to do their job? Ours answers it for August 21, 2026. It does not test how those controls performed over time. That is what a Type II report does, and it is the next report we expect. We would rather tell you exactly what an audit covers than let a badge imply more than it says. Some things sit outside any audit of Bower:
  • Google Cloud Platform, which hosts Bower, is a subservice organization. Both reports assume Google operates the controls it is responsible for; Google’s own controls are covered by Google’s own audits.
  • Your organization’s controls. The reports list complementary user entity controls, the things your team is responsible for. Examples include adding and removing workspace members promptly with the least-privileged role, and signing a BAA with Bower and designating the workspace accordingly before uploading PHI.
  • Integrations you connect. Third-party tools you link to Bower are governed by their own terms. The sub-processor list shows which providers are covered by a BAA.

​
How do we get a copy of the reports?

SOC 2 and HIPAA reports are restricted-use documents: the auditor limits them to Bower’s customers and prospective customers, business partners, the practitioners who serve them, and regulators. Email [email protected] with your organization’s name and we will send them under a mutual NDA. The same address handles security questionnaires and our Data Processing Agreement. To start a BAA, email [email protected].

​
What happens next

  • SOC 2 Type II. The observation period is underway; the report follows when it closes.
  • Annual renewal. We plan to renew our SOC 2 and HIPAA reports every year. SOC 2 Type II will replace the Type I report.
  • Between audits. We use a compliance platform to monitor our controls between audits, not only in the weeks before one.

​
Further reading