Security & Trust · UAE · Saudi Arabia · USA
Security and Data Protection for Hospital Groups and Government
Neurula Technologies builds and runs clinical and enterprise systems that handle patient and citizen data. This page sets out where that data lives, how it is protected, and what we sign, so your security and procurement teams can review us quickly.
At a glance
Data hosted in-country: UAE, Saudi Arabia or USA, or on your own infrastructure.
Encryption at rest and in transit, field-level encryption of patient data, MFA/SSO, role-based access and full audit logs.
We sign HIPAA Business Associate Agreements, Data Processing Agreements and mutual NDAs.
Independent listings and programmes
-
Cloud Security Alliance STAR Registry
Neurula Technologies is listed in the Cloud Security Alliance (CSA) STAR Registry for a STAR for AI Level 1 self-assessment, published openly for anyone to review, and is a signatory of the CSA AI Trustworthy Pledge 2026. View our registry entry.
-
AWS-certified hosting
Our platforms are hosted on AWS infrastructure that is independently certified to ISO 27001 and SOC 2, so the physical and infrastructure layers carry those certifications.
-
Technology programmes
Neurula Technologies is a member of the NVIDIA Inception Program and Microsoft for Startups Founders Hub.
Your data stays in your country
We deploy each client in-country and write the hosting location into the contract.
United Arab Emirates
Hosted in an AWS region in the UAE, so patient data stays within UAE jurisdiction as Federal Law No. 2 of 2019 requires for health data.
Saudi Arabia
Hosted in-Kingdom for Saudi clients, designed around the Personal Data Protection Law (PDPL) and National Cybersecurity Authority (NCA) controls.
United States
Hosted in US AWS regions for US clients, with administrative, physical and technical safeguards designed around the HIPAA Security Rule.
Your own infrastructure
For government and sovereign deployments we can install on your private cloud or on-premise servers and operate under your security policies.
How we protect data
Data protection
- Encryption at rest (AES-256) for databases and storage
- TLS encryption for all data in transit
- Field-level encryption of sensitive patient data, so it stays unreadable even with database access
- Encrypted backups
Access and audit
- Multi-factor authentication and single sign-on
- Role-based access control: users see only what their role allows
- Audit logs of who viewed or changed each patient record
- No patient data in application or error logs
Testing and incident response
Our security team runs internal penetration testing and regular security assessments of our platforms.
A documented incident response process covers detection, containment, investigation and client notification, including breach-notification obligations under the contract and applicable law.
Contracts we sign
- HIPAA Business Associate Agreement (BAA) for US healthcare clients
- Data Processing Agreement (DPA)
- Mutual NDA before any confidential data or RFP details are shared
Designed around your regulator
UAE
Department of Health Abu Dhabi (DoH) requirements including ADHICS security controls and Malaffi; Dubai Health Authority (DHA) and NABIDH; Ministry of Health and Prevention (MOHAP) and Riayati. Read our UAE healthcare compliance guide.
Saudi Arabia
Designed to align with the PDPL and NCA controls, with NPHIES integration readiness for insurance workflows.
United States
Designed around HIPAA Security Rule safeguards, with BAAs available and FHIR-based integration with EHR systems.
Standards
ISO 27001 certification is on our roadmap. Clients can review our controls, architecture and incident response process under NDA today.
Security questions procurement teams ask
Where is patient data stored?
Neurula Technologies deploys in-country: in an AWS region in the UAE for UAE clients, in Saudi Arabia for Saudi clients and in the United States for US clients, or on the client's own infrastructure. The hosting location is written into the contract.
Will you sign a HIPAA Business Associate Agreement?
Yes. Neurula Technologies signs a HIPAA Business Associate Agreement (BAA) with US healthcare clients, and a Data Processing Agreement (DPA) with clients in other jurisdictions.
Do you hold ISO 27001 certification?
Neurula Technologies' platforms run on AWS infrastructure that is independently certified to ISO 27001 and SOC 2, and Neurula shares its security controls and documentation with clients under NDA. Neurula's own ISO 27001 certification is on our roadmap.
What third-party security listings does Neurula hold?
Neurula Technologies is listed in the Cloud Security Alliance (CSA) STAR Registry for a STAR for AI Level 1 self-assessment, and is a signatory of the CSA AI Trustworthy Pledge 2026.
Can we review your security documentation before contracting?
Yes. Request the Neurula security pack and the team will send it under a mutual NDA: an architecture and data-flow overview, a description of security controls, the incident response process and answers to your security questionnaire.
Running a vendor security review?
We'll send our security pack under NDA and answer your questionnaire, so your review isn't held up waiting on us.