Security & Compliance Overview

One place to find every compliance artifact for AMC procurement, IT-security review, and NIH program officers.

Baseshift is SOC 2 Type II ready — final audit report available under NDA from sales@baseshift.io.

HECVAT 4.0 → SOC 2 crosswalk

For AMC InfoSec reviewers: every HECVAT 4.0 domain is mapped to the applicable SOC 2 Trust Service Criteria, with the section of the audit report that contains the supporting evidence.

/hecvat-crosswalk →

NIST SP 800-53 Rev. 5 mapping

For federal and NIH program officers, and IT-security teams: Baseshift implementation references for each NIST SP 800-53 control family relevant to clinical genomic data processing.

/nist-mapping →

Genomic Data Use Agreement addendum

For AMC procurement and contracting teams: a pre-publishable DUA addendum template covering permitted use, prohibited re-identification, breach notification, and termination clauses.

/sales/dua-addendum →

SOC 2 Type II report available under NDA. A NIST SP 800-53 Rev. 5 control mapping is available at the NIST 800-53 Mapping page. For NIH-funded and academic medical center customers requiring a signed BAA + DUA before engagement, see the Genomic Data Use Agreement Addendum template. For procurement FAQ answers (data residency, PHI handling, BAA terms, exit clauses), see the Baseshift FAQ, or scope a 30-Day Pilot. For a one-page summary of Baseshift's compliance posture for AMC procurement reviews, see the Academic Medical Centers One-Pager. Contact sales@baseshift.io to request the SOC 2 report or an executed agreement.