Security

Our commitment

LongevAI protects the confidentiality, integrity and availability of the information entrusted to us. Our controls are proportionate to risk and to the sensitivity of the data, with priority given to the health data processed through LongevOS. Our top management has established an Information Security Policy that binds every person working for LongevAI, and reviews it at least annually.

Certification status

LongevAI is ISO 27001 certified. An independent auditor checks how we protect information every year. We also comply with the GDPR and the Dutch UAVG.

Verify our certificate↗(opens in a new tab)

AI and your patients' data

Google Cloud (Vertex AI, Gemini) is our sole AI sub-processor for patient health data. That processing runs under a data processing agreement, in the clinic's region (the EU, Singapore, the UAE or the US), and your data is never used to train models. Client names are removed from AI assistant prompts. Every clinical AI output is a draft that a clinician reviews and approves before a client sees it, and it links back to the source data it came from. When a clinician corrects a report, LongevOS can propose a written rule for future reports; the rule applies only after a clinician confirms it, contains no client data, and can be viewed or switched off at any time. We also use other AI providers for internal tooling; those providers never receive patient or health data.

Access and encryption

Access is granted on a need-to-know basis, and we apply the following as standard:

• Multi-factor authentication is mandatory for production systems, cloud infrastructure and source code
• Access rights are reviewed every quarter, and revoked no later than the last working day on termination or role change
• Shared accounts are prohibited on production systems
• Data in transit is protected with TLS 1.2 or higher; data at rest with AES-256 or equivalent
• Encryption keys are held with restricted access

Secure development

Security is built into our development process from design onward. Changes reach production only through our automated test and release pipeline. Our pipelines scan dependencies for known vulnerabilities and analyse our source code with automated static security analysis every week (on Mondays) and on demand, and secret scanning (gitleaks) runs on every pull request. Secrets are kept out of our source repositories and held in managed secret stores. Production is separated from development and staging, and production data is not used for testing without authorisation and masking.

Incidents and breach notification

Suspected incidents are reported immediately to our Information Security Manager. Where personal data of a clinic's clients is involved, we notify the clinic that controls the data without undue delay and within 24 hours of becoming aware. The clinic then decides on notifying the regulator and the affected individuals. All incidents are recorded and investigated, and significant incidents receive a root cause analysis.

Continuity, backup and suppliers

We maintain documented business continuity and disaster recovery plans. For LongevOS our recovery point objective is 1 hour, and we restore the service within 24 hours after a loss of the hosting environment. Encrypted backups run every hour, are stored securely, and we test a full restore at least once a year. Vendors that process our information are assessed for security before engagement and annually thereafter, and carry contractual security and incident-notification obligations. A data processing agreement is in place before any third party processes personal data on our behalf.

Documents you can review

The following are part of every client contract, and prospective clients can review them before signing. Write to info@longevai.nl or ask during your demo.

• Data processing agreement
• Full sub-processor list, with processing locations
• Data retention and deletion policy
• Business continuity and disaster recovery plan, with recovery targets
• Incident response procedure and breach notification terms
• Summary of our internal security testing (Q2 and October 2026)
• Our ISO 27001 certificate, Statement of Applicability and Information Security Policy

Our people

Everyone completes security awareness training before receiving system access and annually thereafter, with completion recorded. Signing our Acceptable Use Policy and a confidentiality agreement is a condition of engagement. Personnel with access to health data are screened to the extent permitted by law.

Requesting our Information Security Policy

This page summarises our Information Security Policy. The full policy is classified for internal use, because it names individual responsibilities and the internal structure of our management system. We make it available to clients, prospective clients, auditors and other interested parties on request, under a confidentiality agreement where appropriate. Write to info@longevai.nl.

Reporting a vulnerability

If you believe you have found a security vulnerability in any LongevAI service, write to info@longevai.nl with enough detail to reproduce it. We will confirm receipt and keep you informed while we investigate. Please give us a reasonable period to resolve the issue before disclosing it publicly.