Loading...
The architecture is the differentiator, not the brochure. SMART on FHIR inside Epic, Oracle Health, and regional EHRs. On-premises and regional cloud deployments. SOC 2 Type II audit in progress, Type I attestation available now. 21 CFR Part 11 e-signature trail built in. HIPAA, GDPR, and regional sovereignty aligned.
SOC 2 Type II audit kicked off Q2 2026. ISO 27001 mapped, formal certification 2027. Eligible for the CDER Emerging Drug Safety Technology Program; EDSTP application in review. Two patents filed on the cascading constraint architecture. CancerX member, the HHS Cancer Moonshot Initiative.
Architecture diagram, BAA, residency configuration, and procurement artifact list available before the first call. Single-document downloads from the procurement portal.
Audit kicked off Q2 2026. Type I attestation available now. ISO 27001 mapped, formal certification 2027. Type II report planned H1 2027 once the observation window completes.
Residency at launch: US, EU, UK, Canada, Australia, Japan, Korea, Singapore, UAE, KSA. Sovereign cloud partnerships in negotiation.
The folder she brought is thin: the 5-page Architecture and Implementation Brief, the executed BAA, the executed DPA, the Q2 SOC 2 Type I attestation, the residency configuration confirmation, and the subprocessor list. Seven weeks. Historically five months.
The architecture is the procurement asset.A CISO walks into a quarterly vendor review meeting, six weeks into a Burna pilot.
Every CISO reading this page is on her fourth healthcare AI vendor evaluation this quarter. Three vendors shipped marketing copy and a Tier 2 diagram on request. One vendor shipped the diagram on day one. Burna is that vendor.
Email security@burna.ai →The 5-page Architecture and Implementation Brief is the single artifact that opens every procurement conversation. The brief is available before the mutual NDA, before the first scoping call, before any commercial discussion.
Email security@burna.ai with the requesting institution and the named reviewer. The brief arrives the same business day. Mutual NDA is available for organizations that require one before the brief; standard turnaround is under 48 hours.
The architecture is the differentiator, not the brochure.
Burna is a SMART on FHIR application that runs inside the customer's EHR. In on-premises deployments, patient identifiers stay inside the hospital network. In regional cloud deployments, identifiers stay inside the customer's jurisdiction. The grading model only sees de-identified clinical text.
Read the full engine architecture →The engine is a twelve-agent cascading constraint pipeline. Each agent's output bounds the valid output space of every downstream agent. Every grade requires a source sentence in the clinical note and a matching CTCAE criterion in the retrieval index. Without both, the engine returns “no grade available.” Architectural constraint, not runtime filter. Two patents filed.
The chain terminates with the clinician's e-signature on the encoded record.
Patient identifiers stay inside the customer's network in on-premises deployments. Patient identifiers stay inside the customer's jurisdiction in regional cloud deployments. Data does not cross jurisdictional boundaries without explicit configuration. The grading model only sees de-identified clinical text.
Sovereign cloud partnerships in negotiation: Oracle Cloud Australia for ANZ sovereign deployments. G42 for UAE national cloud. STC Cloud for Saudi Arabia national cloud. On-premises deployment available for institutions with mature security operations centers.
Same audit trail format. Same compliance posture. The difference is where the engine runs, where PHI sits, and what the retrieval layer is allowed to reach for.
Multi-tenant SaaS hosted in the customer's region of record. Logical isolation per tenant. Standard for cancer centers and CROs with established cloud risk acceptance. SOC 2 controls, HIPAA BAA, regional residency, and the full procurement artifact set apply.
Single-tenant, isolated from other customers. Data resides in the customer's specified region. Per-tenant encryption keys. Customer-managed KMS optional. Burna manages infrastructure under a Business Associate Agreement. Standard for AMCs with enhanced isolation requirements.
Logically isolated tenant with dedicated encryption keys per sponsor. The trial protocol stays inside the sponsor's environment. Content Boundary Middleware enforces fail-closed validation; only structured probability scores leave the boundary. The sponsor's CISO and General Counsel review the same artifact set as a cancer center customer, plus the Content Boundary Middleware specification.
Pre-negotiated, single-document downloads. General Counsel review measured in weeks, not quarters. Customer notification precedes any subprocessor change. All subprocessors operate under a HIPAA BAA where PHI may be processed.
Every document the GC will ask for, pre-prepared.
The public trust statement at /security-and-compliance is the calm declarative companion. This page covers the procurement-grade detail.
Read the trust statement →PHI handling in concrete terms. In on-premises deployments, PHI never leaves the customer's network. In regional cloud deployments, PHI stays inside the customer's jurisdiction. Zero PHI in logs by pre-commit enforcement. Burna does not train on customer data without explicit opt-in and governance review. Ever.
Updates are opt-in, not automatic. No silent updates. No mandatory upgrades on a timeline that does not fit the customer's governance cadence.
Model card
Documenting training data provenance, evaluation results against a standard benchmark, known limitations, and recommended supervision level.
Baseline
Performance is measured against the customer's established baseline at site, not against a vendor benchmark.
Rollback
In case of a regression detected in the customer's environment, the previous model version is one click away.
Regulatory
For engagements under 21 CFR Part 11 or GVP Module VI, the regulatory review package ships with every update.
Notification first, formal determination second. Suspected breaches affecting customer data are disclosed without waiting on root cause analysis to complete.
24/7 on-call. Sev 1 response target: 15 minutes.
“The folder she brought is thin: the 5-page Architecture and Implementation Brief, the executed BAA, the executed DPA, the Q2 SOC 2 Type I attestation, the residency configuration confirmation, and the subprocessor list. Seven weeks. Historically five months.”
The architecture is the procurement asset.Monday morning at a cancer center, six weeks into a Burna pilot.
The CISO walks into the quarterly vendor review meeting with the institution's General Counsel, the Chief Compliance Officer, and the Director of Clinical Trials. The annual right-to-audit clause is scheduled for September.
The General Counsel reviewed the MSA in four business days. The compliance officer mapped Burna's controls to the institution's HIPAA risk register without exceptions. The Director of Clinical Trials confirmed the SMART on FHIR integration is live inside Epic and the patient identifiers have never left the network. The CISO closed a procurement cycle in seven weeks that historically took her team five months.
The next agenda item is the institution's third healthcare AI vendor of the quarter. The folder for that one is three inches thick and still missing the architecture diagram.
The ten we hear most often. The cross-site FAQ has more.
Read the full FAQ →AWS (US, EU, APAC, ANZ regions) and Azure (US, EU, UK, APAC regions) at launch. GCP on request. Sovereign cloud partnerships in negotiation for Oracle Cloud Australia, G42 UAE, and STC Saudi Arabia.
Multi-zone replication within the customer's region of record. RTO under 4 hours for production tenants. RPO under 15 minutes for the operational database. Annual DR drill report available on request.
AES-256 at rest. TLS 1.3 in transit. KMS-managed encryption keys. Per-tenant encryption keys for sponsor-tenant deployments. Customer-managed KMS available for single-tenant engagements.
Annually, by an independent third party. Redacted report available pre-contract. Critical findings remediated within 14 days; high within 30; medium within 90. Enterprise customers are invited to run a pen test against a scoped test environment before production go-live.
SAML 2.0 SSO, OIDC, OAuth 2.0. SCIM provisioning supported. Two-factor authentication required for all production access. Quarterly access reviews documented.
The full subprocessor list is published and customer notification precedes any change. Current subprocessors include the cloud provider (AWS or Azure depending on region), model hosting for Protocol Safe deployments, observability tooling, and standard development infrastructure. All subprocessors operate under a HIPAA BAA where PHI may be processed.
Patient identifiers stay inside your network in on-premises deployments and inside your jurisdiction in regional cloud deployments. The grading model only sees de-identified clinical text. The full data flow diagram is in the 5-page Architecture and Implementation Brief.
No. Burna is a clinical decision support tool. Clinicians approve every output. The platform does not prescribe, modify dose, or alter care pathways. 21 CFR Part 11, SOC 2, HIPAA, and GDPR aligned. Eligible for the CDER Emerging Drug Safety Technology Program; EDSTP application in review.
The customer controls the update cadence. Updates are opt-in. Each update ships with a model card, a baseline comparison against the customer's site performance, a rollback path, and a regulatory review package for engagements under 21 CFR Part 11 or GVP Module VI.
90-day exit window. Data export in FHIR, CSV, and HL7 standard formats. Source code escrow option available for enterprise engagements. The 12-pillar Implementation Playbook artifacts, training materials, and workflow maps stay with the customer.
The 5-page brief covers the architecture diagram, the data flow diagram, the cloud partner list with HIPAA BAAs in place, the implementation timeline by week, the procurement and legal documentation, and the IT-specific FAQ.
Available before the mutual NDA, before the first scoping call, before any commercial discussion. Brief arrives the same business day.
Mutual NDA available for organizations that require one; standard turnaround under 48 hours.
Direct conversation with the Founder and CEO covers the architecture, the validation roadmap, and the deployment pattern that fits your environment.
For evaluations later in 2026, subscribe to the quarterly briefing: architecture updates, compliance certification milestones, and validation readouts only.
Subscribe to the quarterly safety and data quality briefing. Architecture updates, compliance certification milestones, and validation readouts only. No tracking beacons, no marketing email cadence.