Privacy first. Compliance-ready by design.
Higgins runs as a safe and secure AI environment: your private company data and intellectual property are not permitted to leave your environment, and usage and permissions are governed centrally.
Higgins is designed to support customers’ compliance programs for these frameworks. Certifications, attestations and Business Associate Agreements are scoped per deployment; confirm the current status and scope with Higgins before relying on them.
How the privacy model works
Your data stays in your environment
Company data and IP are never permitted to leave your environment. Outside information is requested and returned without exposing what is private.
Permissions and usage controls
A global standardized internal AI with usage and permissions means associates see only what their role allows, and administrators can see how AI is used.
Validated connections
Higgins uses validated connections and APIs to your repositories and applications, and can read from backups so production systems stay untouched.
IT approval built in
Rollout includes finalizing and ratifying risk assessments and performing security testing on the system, including APIs, so Higgins is approved through your IT process.
Human in the loop
Higgins drafts, retrieves and recommends. Your people review and approve, especially for regulated content and actions.
Fresh, governed data
Data and AI training can be refreshed daily or weekly from approved sources so answers stay current and traceable.
Higgins safe and secure AI environment
Frameworks Higgins is designed to support
Use this table as a starting point for your security questionnaire and risk assessment. Controls are shared between Higgins and the customer.
| Framework | What it governs | How the Higgins architecture supports it |
|---|---|---|
| HIPAA | Protected health information (PHI) in US healthcare | Data stays in your environment; role-based permissions limit access; usage records support audit; Business Associate Agreement scoped per deployment. |
| GDPR | Personal data of people in the EU/EEA | Data minimization through scoped connections; central control of who can access which data; support for access and deletion processes; data residency set per deployment. |
| CCPA / CPRA | Consumer privacy rights in California | Governed access and retention settings that help you honor access and deletion requests. |
| SOC 2 | Security, availability, processing integrity, confidentiality, privacy controls | Access control, monitoring and change management that align to the trust services criteria; report availability confirmed per deployment. |
| 21 CFR Part 11 | Electronic records and signatures in FDA-regulated work | Attributable user activity, controlled access and human review before records are finalized; validation support for GxP workflows. Final records stay in your validated systems. |
| ISO 27001 | Information security management system | Controls for access, encryption, supplier and change management that map to Annex A themes. |
| ISO 9001 / ISO 13485 / Six Sigma / ASTM | Quality management and standards content | Best-practice AI draws on quality standards content and your own SOPs so teams work from the current procedure. |
| NIST AI RMF & ISO/IEC 42001 | AI risk management and AI management systems | Governed use cases, documented permissions, monitoring of usage and human oversight support the Govern, Map, Measure and Manage functions. |
| EU AI Act | Risk-based obligations for AI providers and deployers | Transparency, human oversight and logging support deployer obligations; classify each use case with your counsel. |
Shared responsibility
Higgins provides the secure platform and controls. You decide which sources to connect, who can access them, how long records are retained and which outputs require approval.
Learn more
Read the guide to enterprise AI governance, security and compliance, the playbook on shadow AI, and how Higgins fits regulated industries.
Security FAQ
Is Higgins HIPAA compliant?
Higgins is designed to support HIPAA programs: PHI stays in your environment, access is permission-controlled and usage can be audited. Whether a Business Associate Agreement applies depends on your deployment, so contact Higgins to confirm scope before using PHI.
Does Higgins train public models on our data?
No. Private company data and IP are not permitted to leave your environment, and your information is not used to improve public models.
Is Higgins suitable for 21 CFR Part 11 and GxP environments?
Higgins supports GxP work by retrieving the current approved SOPs, drafting documents and keeping people in control of approval. Official records and electronic signatures remain in your validated systems. Validation scope is agreed per deployment.
Can we limit what each associate can see?
Yes. Usage and permissions are managed centrally, with management by corporation and by function or department, and optimization at team and associate level.
How do you handle risk assessments and security testing?
The rollout plan includes finalizing and ratifying risk assessments and performing security testing on the system, including APIs to connected applications, so Higgins is approved through your IT process before beta launch.
Where can I get a security questionnaire answered?
Use the Request security documentation button or email enterprise@higgins.ai. To use Higgins you will sign in at higgins.ai.
Ready to get Higgins?
Tell us about your organization and the applications you want connected. We will reply with next steps. To use Higgins you will sign in at higgins.ai.