Skip to content

Security, open for review.

Give your security and procurement teams a clear view of B3IQ. Review our completed assessments, or ask for the documents your team needs to move forward.

Request security documents Reviewed Sep 30, 2026 · NPC Labs, Inc.

01 / Assurance

Assessments and progress.

Review what is complete
and the milestones ahead.

Each assessment has its own scope. SOC 2 and ISO reports are not yet available.

Public and requested documents
External scan passed

PCI external vulnerability scan

Clone Systems issued a passing scan attestation for NPC Labs, Inc., covering PCI DSS Requirement 11.3.2.

Scan issuerClone Systems
Scan completed
Sep 28, 2026
Certificate valid through
Dec 27, 2026
Scope
b3iq.org · 1 component

This covers external vulnerability scanning for the component scanned. It is not an assessment of overall PCI DSS compliance or of our GPU fleet.

Scan review note

The vendor reports PASS. The executive summary also includes a scanner-configuration warning; request the report and clarification for your review.

View scan certificate Verify with issuer

HECVAT assessment

Completed

Our completed HECVAT questionnaire gives higher-education security teams a structured view of B3IQ's controls. Request it for your institution's vendor review.

Full questionnaire · vendor self-assessment

Evidence reviewed Sep 30, 2026

Request completed HECVAT
In progress

SOC 2 Type II

Target: January 2027

Audit underway with A-LIGN. The report has not been issued. January is a target, subject to completion of the audit.

Evidence reviewed Sep 30, 2026

Audit providerA-LIGN
Security practices
In progress

HIPAA readiness

Target: January 2027

Readiness work is in progress. We already sign BAAs for agreed workloads; an executed BAA and a review of your deployment's scope are required before handling PHI.

Evidence reviewed Sep 30, 2026

BAA and workload scope
Planned

ISO 27001

Timing to be confirmed

Planned for our compliance roadmap. Certification work has not started, and no certificate has been issued.

Evidence reviewed Sep 30, 2026

Ask about the roadmap

02 / Evidence library

For your security team.

Public evidence is ready to view.
Request supporting documents for your review.

PCI external scan certificate

Vendor-issued certificate · Sep 28–Dec 27, 2026 · external scan only

Public PDF

Attestation of Scan Compliance

Sep 28, 2026 · scan scope and vendor attestation

By request

PCI scan executive summary

Sep 28, 2026 · findings and scanner-configuration note

By request

HECVAT questionnaire

Full version completed · vendor security assessment

By request

Security policy set

Access control, incident response, business continuity and data handling

By request

Subprocessor register

Providers and the data shared with each

By request

Business Associate Agreement

For agreed healthcare workloads · reviewed and signed by both parties

By request

Requests open your email app. You can also write to contact@npclabs.org. SOC 2 and ISO reports are not yet available.

03 / Security and privacy

How we handle your workloads.

Understand how B3IQ handles your data
and what your deployment needs.

Data handling

Read our prompt retention, training and request-metadata policies.

Privacy policy

Access and infrastructure

Review authentication, encryption, routing and our development practices.

Security overview

Service availability

Check current availability and published incident updates.

Service status

04 / Common questions

Before you deploy.

Planning a deployment? Let’s work through
your security requirements.
Talk to our team ↗

What does the PCI scan establish?

This covers external vulnerability scanning for the component scanned. It is not an assessment of overall PCI DSS compliance or of our GPU fleet.

PCI SSC guidance on ASV scans ↗
Is B3IQ HIPAA certified?

HHS does not recognize private HIPAA certifications. Our readiness program and the BAA describe different things: the program is in progress, while a BAA sets out the agreed responsibilities for your specific deployment.

Read the scope and setup requirements ↗
Can I download the full reports?

The external scan certificate is public. The attestation and executive report are confidential and shared by request. Email us with the documents you need and the context of your review; please keep PHI and other sensitive workload data out of the request.

Request documents by email ↗
Where can I report a security issue?

Email contact@npclabs.org with SECURITY in the subject. Our security page describes responsible disclosure and how we handle reports.

Responsible disclosure ↗