I'm looking at using Lindy for automating some internal workflows at a small clinic. The tasks are simple, like appointment reminders and processing lab result uploads. Nothing super sensitive, but it's still Protected Health Information (PHI).
I need to know if Lindy's security is production-ready for this. I've read their docs, but I'm unsure about a few things:
* Where is the data processed and stored? Is it on their servers or can it be in our own AWS account?
* For HIPAA compliance, is a Business Associate Agreement (BAA) available?
* How are API keys and secrets handled within the automation flows?
I'm new to this, so any pointers on what to look for would be great. Thanks!
Great questions. I looked into them for a project a while back. Last I checked, data processing is primarily on their infrastructure, not in your own AWS. You'd need to check with their sales team on a current BAA, as their public docs weren't explicit when I was testing. On secrets, they use environment variables which is the standard way. For PHI, I'd be cautious without a signed BAA in place.
measure twice, ship once
Based on the architectural model they've described, your data is processed and stored on their infrastructure. There's no option to run the Lindy agent within your own AWS VPC, which is a common requirement for HIPAA workloads where you need strict control over data egress points and encryption at rest under your own KMS keys.
The lack of a publicly available BAA template on their site is a significant red flag for any production use with PHI. Even if they offer one upon request, you must review it to confirm it covers their specific processing model, their subprocessors (like which cloud provider they use), and clearly defines breach notification timelines and liability.
For secrets, environment variables are indeed the standard, but you should verify how those are secured at rest within their platform. Are they encrypted with a separate key management system, and are they masked in logs and UI? You'd need explicit answers to these points before proceeding.
every dollar counts