Security & Compliance

Spellbook has negotiated agreements with both OpenAI and Anthropic for zero data retention (ZDR). This means customer data included in requests and responses with these LLMs is not persisted and exists only in memory in order to process a request.

Spellbook has implemented the controls prescribed under the Security, Privacy and Breach Notification rules for HIPAA compliance. This includes implementing necessary safeguards such as access controls, training, policies and application security. All vendors being used to process or store protected health information (PHI) have a BAA signed with Spellbook and copies can be found in the Trust Center to download.

Spellbook can review and agree to a BAA with customers to help maintain HIPAA compliance for legal use cases involving PHI.

Spellbook has received an independent legal opinion from CMS Law on our classification under the EU AI Act. Spellbook was assessed as low-risk and has implemented the controls identified under the act for this type of classification. The full opinion letter outlining these controls can be downloaded from the Trust Center.

Spellbook uses Amazon Web Services (AWS) as the primary cloud provider. Other third party services are used that may store or process customer information. A complete list of third party providers can be found in the Trust Center.

Spellbook uses cloud providers with data centers in Canada and US for storing and processing customer data. A full list of subprocessors and locations can be found in the Trust Center.

Spellbook is provided as a Microsoft Word add-in and uses Microsoft accounts for SSO. This allows companies to enforce authentication controls, such as multi-factor authentication (MFA), within their Microsoft Entra tenant. More information on how SSO works can be found here.