HIPAA & Business Associate Agreements — What a BAA doesn't change

A BAA covers health data. It does not make RowFold suitable for US government data - we hold no FedRAMP authorization, which is granted after third-party assessment with an agency sponsor, and no BAA affects that. Card numbers should also never be stored in RowFold: payment details go to Stripe and never reach us. Our full position on every regime, including SOC 2, ISO 27001 and GDPR, is on the public Compliance page.