What has been examined, and what we have committed to
SOC 2 Type 1
Report issued
Controls as of
August 31, 2026
Report issued
September 23, 2026
Independent CPA firm
Percilchofe CPA LLC
Arxova completed a SOC 2 Type 1 examination covering the Security criteria, as of August 31, 2026. The report was issued by Percilchofe CPA LLC on September 23, 2026. A Type 1 report looks at how our controls were designed at one point in time. It does not test how they operated over a period; that is a Type 2 report. We are currently working toward a SOC 2 Type 2 examination. SOC 2 is an attestation report, not a certification.
HealthKey Labs, LLC, the company behind Arxova, has signed the CARIN Alliance Code of Conduct for consumer-facing health apps. Before sending the Code for signature, the CARIN team reviewed Arxova in a live demonstration on October 20, 2026, to confirm it is a consumer-facing app that is available to the public and connected to a FHIR API. Arxova is listed in CARIN's My Health Application directory. Signing the Code is a self-attestation: the CARIN Alliance does not certify or endorse listed apps. We're publishing it so you can hold us to it.
HealthKey Labs, LLC is an approved participant in the CMS Health Tech Ecosystem, in the “Patient Facing Apps — Conversational AI Assistants” and “Patient Facing Apps — Kill the Clipboard” categories. Participation is not a CMS endorsement or certification of Arxova’s clinical functionality or legal compliance.
A Type 1 report looks at how our controls were designed at one point in time. It does not test how they operated over a period; that is a Type 2 report. SOC 2 is an attestation report, not a certification.
Self-attestation
Signing the CARIN Code of Conduct is a public commitment Arxova makes about itself. It is not an audit, a certification, or an endorsement by the CARIN Alliance.
